Data Protection Act 2018 in Northern Ireland

2018 c. 12 · Enacted 23 May 2018 · Extends to United Kingdom

Contents

1. Part 1: Preliminary
2. 1Overview
3. 2Protection of personal data
4. 3Terms relating to the processing of personal data
5. Part 2: General processing
6. Chapter 1: Scope and definitions
7. 4Processing to which this Part applies
8. 5Definitions
9. Chapter 2: The UK GDPR
10. Meaning of certain terms used in the UK GDPR
11. 6Meaning of “controller”
12. 7Meaning of “public authority” and “public body”
13. Lawfulness of processing
14. 8Lawfulness of processing: public interest etc
15. 9Child's consent in relation to information society services Repealed
16. Relevant international law
17. 9AProcessing in reliance on relevant international law
18. Special categories of personal data
19. 10Special categories of personal data and criminal convictions etc data
20. 11Special categories of personal data etc: supplementary
21. Rights of the data subject
22. 12Limits on fees that may be charged by controllers
23. 13Obligations of credit reference agencies
24. 13AMeaning of “relevant offence” for purpose of right to erasure
25. 14Automated decision-making authorised by law: safeguards Repealed
26. Exemptions etc
27. 15Exemptions etc
28. 16Power to make further exemptions etc by regulations
29. Certification
30. 17Accreditation of certification providers
31. ...
32. 17ATransfers based on adequacy regulations Repealed
33. 17BTransfers based on adequacy regulations: review etc Repealed
34. 17CStandard data protection clauses Repealed
35. 18Transfers of personal data to third countries etc : public interest Repealed
36. ...
37. 19Processing for archiving, research and statistical purposes: safeguards Repealed
38. Minor definition
39. 20Meaning of “court” Repealed
40. Chapter 3: Exemptions for manual unstructured processing and for national security and defence purposes
41. Definitions
42. 21Definitions
43. ...
44. 22Application of the GDPR to processing to which this Chapter applies Repealed
45. 23Power to make provision in consequence of regulations related to the GDPR Repealed
46. Exemptions etc
47. 24Manual unstructured data held by FOI public authorities
48. 25Manual unstructured data used in longstanding historical research
49. 26National security and defence exemption
50. 27National security: certificate
51. 28National security and defence: modifications to Articles 9 and 32 of the UK GDPR
52. Part 3: Law enforcement processing
53. Chapter 1: Scope and definitions
54. Scope
55. 29Processing to which this Part applies
56. Definitions
57. 30Meaning of “competent authority”
58. 31“The law enforcement purposes”
59. 32Meaning of “controller” and “processor”
60. 33Other definitions
61. Chapter 2: Principles
62. 34Overview and general duty of controller
63. 35The first data protection principle
64. 36The second data protection principle
65. 37The third data protection principle
66. 38The fourth data protection principle
67. 39The fifth data protection principle
68. 40The sixth data protection principle
69. 40AConditions for consent
70. 41Safeguards: archiving
71. 42Safeguards: sensitive processing
72. 42AFurther provision about sensitive processing
73. Chapter 3: Rights of the data subject
74. Overview and scope
75. 43Overview and scope
76. Data subject’s rights to information
77. 44... Controller's general duties
78. ...
79. 45Right of access by the data subject
80. 45AExemption from sections 44 and 45: legal professional privilege
81. Data subject's rights to rectification or erasure etc
82. 46Right to rectification
83. 47Right to erasure or restriction of processing
84. 48Rights under section 46 or 47: supplementary
85. Automated individual decision-making
86. 49Right not to be subject to automated decision-making Repealed
87. 50Automated decision-making authorised by law: safeguards Repealed
88. 50AAutomated processing and significant decisions
89. 50BRestrictions on automated decision-making based on sensitive processing
90. 50CSafeguards for automated decision-making
91. 50DFurther provision about automated decision-making
92. Supplementary
93. 51Exercise of rights through the Commission
94. 52Form of provision of information etc
95. 53Manifestly unfounded or excessive requests by the data subject
96. 54Meaning of “applicable time period”
97. Chapter 4: Controller and processor
98. Overview and scope
99. 55Overview and scope
100. General obligations
101. 56General obligations of the controller
102. 57Data protection by design and default
103. 58Joint controllers
104. 59Processors
105. 60Processing under the authority of the controller or processor
106. 61Records of processing activities
107. 62Logging
108. 63Co-operation with the Commission
109. 64Data protection impact assessment
110. 65Prior consultation with the Commission
111. Obligations relating to security
112. 66Security of processing
113. Obligations relating to personal data breaches
114. 67Notification of a personal data breach to the Commission
115. 68Communication of a personal data breach to the data subject
116. Data protection officers
117. 69Designation of a data protection officer
118. 70Position of data protection officer
119. 71Tasks of data protection officer
120. Codes of conduct
121. 71ACodes of conduct
122. Chapter 5: Transfers of personal data to third countries etc
123. Overview and interpretation
124. 72Overview and interpretation
125. General principles for transfers
126. 73General principles for transfers of personal data
127. 74Transfers on the basis of an adequacy decision Repealed
128. 74ATransfers based on adequacy regulations Repealed
129. 74AATransfers approved by regulations
130. 74ABThe data protection test
131. 74BTransfers approved by regulations: monitoring
132. 75Transfers subject to appropriate safeguards
133. 76Transfers based on special circumstances
134. Additional conditions
135. 77Additional conditions for transfers in reliance on section 73(4)(b)
136. Subsequent transfers
137. 78Subsequent transfers
138. Chapter 6: Supplementary
139. 78ANational security exemption
140. 79National security: certificate
141. 80Special processing restrictions
142. 81Reporting of infringements
143. Part 4: Intelligence services processing
144. Chapter 1: Scope and definitions
145. Scope
146. 82Processing to which this Part applies
147. 82ADesignation of processing by a qualifying competent authority
148. 82BDuration of designation notice
149. 82CReview and withdrawal of designation notice
150. 82DRecords of designation notices
151. 82EAppeal against designation notice
152. Definitions
153. 83Meaning of “controller” and “processor”
154. 84Other definitions
155. Chapter 2: Principles
156. Overview
157. 85Overview
158. The data protection principles
159. 86The first data protection principle
160. 87The second data protection principle
161. 88The third data protection principle
162. 89The fourth data protection principle
163. 90The fifth data protection principle
164. 91The sixth data protection principle
165. 91AFurther provision about sensitive processing
166. Chapter 3: Rights of the data subject
167. Overview
168. 92Overview
169. Rights
170. 93Right to information
171. 94Right of access
172. 95Right of access: supplementary
173. 96Right not to be subject to automated decision-making
174. 97Right to intervene in automated decision-making
175. 98Right to information about decision-making
176. 99Right to object to processing
177. 100Rights to rectification and erasure
178. Chapter 4: Controller and processor
179. Overview
180. 101Overview
181. General obligations
182. 102General obligations of the controller
183. 103Data protection by design
184. 104Joint controllers
185. 105Processors
186. 106Processing under the authority of the controller or processor
187. Obligations relating to security
188. 107Security of processing
189. Obligations relating to personal data breaches
190. 108Communication of a personal data breach
191. Chapter 5: Transfers of personal data outside the United Kingdom
192. 109Transfers of personal data outside the United Kingdom
193. Chapter 6: Exemptions
194. 110National security
195. 111National security: certificate
196. 112Other exemptions
197. 113Power to make further exemptions
198. Part 5: The Information Commission
199. ...
200. 114The Information Commissioner Repealed
201. The Information Commission
202. 114AThe Information Commission
203. General functions
204. 115General functions under the UK GDPR and safeguards
205. 116Other general functions
206. 117Competence in relation to courts etc
207. International role
208. 118Co-operation between parties to the Data Protection Convention
209. 119Inspection of personal data in accordance with international obligations
210. 119AStandard clauses for transfers to third countries etc
211. 120Further international role
212. Duties in carrying out functions
213. 120APrincipal objective
214. 120BDuties in relation to functions under the data protection legislation
215. 120CStrategy
216. 120DDuty to consult other regulators
217. Codes of practice
218. 121Data-sharing code
219. 122Direct marketing code
220. 123Age-appropriate design code
221. 124Data protection and journalism code
222. 124AOther codes of practice
223. 124BPanels to consider codes of practice
224. 124CImpact assessments for codes of practice
225. 125Approval of codes prepared under sections 121 to 124A
226. 126Publication and review of codes issued under section 125(4)
227. 127Effect of codes issued under section 125(4)
228. 128Other codes of practice Repealed
229. Consensual audits
230. 129Consensual audits
231. Records of national security certificates
232. 130Records of national security certificates
233. Information provided to the Commission
234. 131Disclosure of information to the Commission
235. 132Confidentiality of information
236. 133Guidance about privileged communications
237. Fees
238. 134Fees for services
239. 135Manifestly unfounded or excessive requests by data subjects etc
240. 136Guidance about fees
241. Charges
242. 137Charges payable to the Commission by controllers
243. 138Regulations under section 137: supplementary
244. Reports etc
245. 139Reporting to Parliament
246. 139AAnalysis of performance
247. Documents and notices
248. 140Publication by the Commission
249. 141Notices from the Commissioner Repealed
250. 141ANotices from the Commission
251. Part 6: Enforcement
252. Information notices
253. 142Information notices
254. 143Information notices: restrictions
255. 144False statements made in response to information notices
256. 145Information orders
257. Assessment notices
258. 146Assessment notices
259. 146AAssessment notices: approval of person to prepare report etc
260. 147Assessment notices: restrictions
261. Information notices and assessment notices: destruction of documents etc
262. 148Destroying or falsifying information and documents etc
263. Interview notices
264. 148AInterview notices
265. 148BInterview notices: restrictions
266. 148CFalse statements made in response to interview notices
267. Enforcement notices
268. 149Enforcement notices
269. 150Enforcement notices: supplementary
270. 151Enforcement notices: rectification and erasure of personal data etc
271. 152Enforcement notices: restrictions
272. 153Enforcement notices: cancellation and variation
273. Powers of entry and inspection
274. 154Powers of entry and inspection
275. Penalties
276. 155Penalty notices
277. 156Penalty notices: restrictions
278. 157Maximum amount of penalty
279. 158Fixed penalties for non-compliance with charges regulations
280. 159Amount of penalties: supplementary
281. Guidance and report
282. 160Guidance about regulatory action
283. 161Approval of first guidance about regulatory action
284. 161AAnnual report on regulatory action
285. Appeals etc
286. 162Rights of appeal
287. 163Determination of appeals
288. 164Applications in respect of urgent notices
289. Complaints
290. 164AComplaints by data subjects to controllers
291. 164BControllers to notify the Commission of the number of complaints
292. 165Complaints by data subjects to the Commission
293. 166Orders to progress complaints to the Commission
294. Remedies in the court
295. 167Compliance orders
296. 168Compensation for contravention of the UK GDPR
297. 169Compensation for contravention of other data protection legislation
298. Offences relating to personal data
299. 170Unlawful obtaining etc of personal data
300. 171Re-identification of de-identified personal data
301. 172Re-identification: effectiveness testing conditions
302. 173Alteration etc of personal data to prevent disclosure to data subject
303. The special purposes
304. 174The special purposes
305. 175Provision of assistance in special purposes proceedings
306. 176Staying special purposes proceedings
307. 177Guidance about how to seek redress against media organisations
308. 178Review of processing of personal data for the purposes of journalism
309. 179Effectiveness of the media's dispute resolution procedures
310. Jurisdiction and court procedure
311. 180Jurisdiction
312. 180AProcedure in connection with subject access requests
313. Definitions
314. 181Interpretation of Part 6
315. Part 7: Supplementary and final provision
316. Regulations under this Act
317. 182Regulations and consultation
318. Changes to the Data Protection Convention
319. 183Power to reflect changes to the Data Protection Convention
320. Prohibitions and restrictions etc on processing
321. 183AProtection of prohibitions and restrictions etc on processing: relevant enactments
322. 183BProtection of prohibitions and restrictions etc on processing: other enactments
323. Rights of the data subject
324. 184Prohibition of requirement to produce relevant records
325. 185Avoidance of certain contractual terms relating to health records
326. 186Protection of data subject’s rights
327. 186AProtection of data subject’s rights: further provision
328. Representation of data subjects
329. 187Representation of data subjects with their authority
330. 188Representation of data subjects with their authority: collective proceedings
331. 189Duty to review provision for representation of data subjects
332. 190Post-review powers to make provision about representation of data subjects
333. Framework for Data Processing by Government
334. 191Framework for Data Processing by Government
335. 192Approval of the Framework
336. 193Publication and review of the Framework
337. 194Effect of the Framework
338. Data-sharing: HMRC and reserve forces
339. 195Reserve forces: data-sharing by HMRC
340. Offences
341. 196Penalties for offences
342. 197Prosecution
343. 198Liability of directors etc
344. 200Guidance about PACE codes of practice
345. The Tribunal
346. 201Disclosure of information to the Tribunal
347. 202Proceedings in the First-tier Tribunal: contempt
348. 203Tribunal Procedure Rules
349. Interpretation
350. 204Meaning of “health professional” and “social work professional”
351. 205General interpretation
352. 206Index of defined expressions
353. Territorial application
354. 207Territorial application of this Act
355. General
356. 208Children in Scotland
357. 209Application to the Crown
358. 210Application to Parliament
359. 211Minor and consequential provision
360. Final
361. 212Commencement
362. 213Transitional provision
363. 214Extent
364. 215Short title
365. Schedule A1Processing in reliance on relevant international law
366. Schedule 1: Special categories of personal data and criminal convictions etc data
367. Part 1: Conditions relating to employment, health and research etc
368. Employment, social security and social protection
369. 1Paragraph 1
370. Health or social care purposes
371. 2Paragraph 2
372. Public health
373. 3Paragraph 3
374. Research etc
375. 4Paragraph 4
376. Part 2: Substantial public interest conditions
377. Requirement for an appropriate policy document when relying on conditions in this Part
378. 5Paragraph 5
379. Statutory etc and government purposes
380. 6Paragraph 6
381. Administration of justice and parliamentary purposes
382. 7Paragraph 7
383. Equality of opportunity or treatment
384. 8Paragraph 8
385. Racial and ethnic diversity at senior levels of organisations
386. 9Paragraph 9
387. Preventing etc unlawful acts
388. 10Paragraph 10
389. Protecting the public against dishonesty etc
390. 11Paragraph 11
391. Regulatory requirements relating to unlawful acts and dishonesty etc
392. 12Paragraph 12
393. Journalism etc in connection with unlawful acts and dishonesty etc
394. 13Paragraph 13
395. Preventing fraud
396. 14Paragraph 14
397. Suspicion of terrorist financing or money laundering
398. 15Paragraph 15
399. Support for individuals with a particular disability or medical condition
400. 16Paragraph 16
401. Counselling etc
402. 17Paragraph 17
403. Safeguarding of children and of individuals at risk
404. 18Paragraph 18
405. Safeguarding of economic well-being of certain individuals
406. 19Paragraph 19
407. Insurance
408. 20Paragraph 20
409. Occupational pensions
410. 21Paragraph 21
411. Political parties
412. 22Paragraph 22
413. Elected representatives responding to requests
414. 23Paragraph 23
415. Disclosure to elected representatives
416. 24Paragraph 24
417. Informing elected representatives about prisoners
418. 25Paragraph 25
419. Publication of legal judgments
420. 26Paragraph 26
421. Anti-doping in sport
422. 27Paragraph 27
423. Standards of behaviour in sport
424. 28Paragraph 28
425. Part 3: Additional conditions relating to criminal convictions etc
426. Consent
427. 29Paragraph 29
428. Protecting individual's vital interests
429. 30Paragraph 30
430. Processing by not-for-profit bodies
431. 31Paragraph 31
432. Personal data in the public domain
433. 32Paragraph 32
434. Legal claims
435. 33Paragraph 33
436. Judicial acts
437. 34Paragraph 34
438. Administration of accounts used in commission of indecency offences involving children
439. 35Paragraph 35
440. Extension of conditions in Part 2 of this Schedule referring to substantial public interest
441. 36Paragraph 36
442. Extension of insurance conditions
443. 37Paragraph 37
444. Part 4: Appropriate policy document and additional safeguards
445. Application of this Part of this Schedule
446. 38Paragraph 38
447. Requirement to have an appropriate policy document in place
448. 39Paragraph 39
449. Additional safeguard: retention of appropriate policy document
450. 40Paragraph 40
451. Additional safeguard: record of processing
452. 41Paragraph 41
453. Schedule 2: Exemptions etc from the UK GDPR
454. Part 1: Adaptations and restrictions as described in Articles 6(3) and 23(1)
455. UK GDPR provisions to be adapted or restricted: “the listed GDPR provisions”
456. 1Paragraph 1
457. Crime and taxation: general
458. 2Paragraph 2
459. Crime and taxation: risk assessment systems
460. 3Paragraph 3
461. Immigration
462. 4Paragraph 4
463. Immigration: safeguards: immigration exemption decisions
464. 4AParagraph 4A
465. Immigration: safeguard: record of decision that exemption applies
466. 4BParagraph 4B
467. Information required to be disclosed by law etc or in connection with legal proceedings
468. 5Paragraph 5
469. Part 2: Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34
470. UK GDPR provisions to be restricted: “the listed GDPR provisions”
471. 6Paragraph 6
472. Functions designed to protect the public etc
473. 7Paragraph 7
474. Audit functions
475. 8Paragraph 8
476. Functions of the Bank of England
477. 9Paragraph 9
478. Regulatory functions relating to legal services, the health service and children's services
479. 10Paragraph 10
480. Regulatory functions of certain other persons
481. 11Paragraph 11
482. 12Paragraph 12
483. Parliamentary privilege
484. 13Paragraph 13
485. Judicial appointments, judicial independence and judicial proceedings
486. 14Paragraph 14
487. Crown honours, dignities and appointments
488. 15Paragraph 15
489. Part 3: Restriction for the protection of rights of others
490. Protection of the rights of others: general
491. 16Paragraph 16
492. Assumption of reasonableness for health workers, social workers and education workers
493. 17Paragraph 17
494. Part 4: Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15
495. UK GDPR provisions to be restricted: “the listed GDPR provisions”
496. 18Paragraph 18
497. Legal professional privilege
498. 19Paragraph 19
499. Self incrimination
500. 20Paragraph 20
501. Corporate finance
502. 21Paragraph 21
503. Management forecasts
504. 22Paragraph 22
505. Negotiations
506. 23Paragraph 23
507. Confidential references
508. 24Paragraph 24
509. Exam scripts and exam marks
510. 25Paragraph 25
511. Part 5: Exemptions etc ... for reasons of freedom of expression and information
512. Journalistic, academic, artistic and literary purposes
513. 26Paragraph 26
514. Part 6: Derogations etc ... for research, statistics and archiving
515. Research and statistics
516. 27Paragraph 27
517. Archiving in the public interest
518. 28Paragraph 28
519. Schedule 3: Exemptions etc from the UK GDPR: health, social work, education and child abuse data
520. Part 1: UK GDPR provisions to be restricted
521. 1Paragraph 1
522. Part 2: Health data
523. Definitions
524. 2Paragraph 2
525. Exemption from the listed GDPR provisions: data processed by a court
526. 3Paragraph 3
527. Exemption from the listed GDPR provisions: data subject's expectations and wishes
528. 4Paragraph 4
529. Exemption from Article 15 of the UK GDPR: serious harm
530. 5Paragraph 5
531. Restriction of Article 15 of the UK GDPR: prior opinion of appropriate health professional
532. 6Paragraph 6
533. Part 3: Social work data
534. Definitions
535. 7Paragraph 7
536. 8Paragraph 8
537. Exemption from the listed GDPR provisions: data processed by a court
538. 9Paragraph 9
539. Exemption from the listed GDPR provisions: data subject's expectations and wishes
540. 10Paragraph 10
541. Exemption from Article 15 of the UK GDPR: serious harm
542. 11Paragraph 11
543. Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
544. 12Paragraph 12
545. Part 4: Education data
546. Educational records
547. 13Paragraph 13
548. 14Paragraph 14
549. 15Paragraph 15
550. 16Paragraph 16
551. Other definitions
552. 17Paragraph 17
553. Exemption from the listed GDPR provisions: data processed by a court
554. 18Paragraph 18
555. Exemption from Article 15 of the UK GDPR: serious harm
556. 19Paragraph 19
557. Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
558. 20Paragraph 20
559. Part 5: Child abuse data
560. Exemption from Article 15 of the UK GDPR: child abuse data
561. 21Paragraph 21
562. Schedule 4: Exemptions etc from the UK GDPR: disclosure prohibited or restricted by an enactment
563. UK GDPR provisions to be restricted: “the listed GDPR provisions”
564. 1Paragraph 1
565. Human fertilisation and embryology information
566. 2Paragraph 2
567. Adoption records and reports
568. 3Paragraph 3
569. Statements of special educational needs
570. 4Paragraph 4
571. Parental order records and reports
572. 5Paragraph 5
573. Information provided by Principal Reporter for children's hearing
574. 6Paragraph 6
575. Schedule 5: Accreditation of certification providers: reviews and appeals
576. Introduction
577. 1Paragraph 1
578. Review
579. 2Paragraph 2
580. Right to appeal
581. 3Paragraph 3
582. Appeal panel
583. 4Paragraph 4
584. Hearing
585. 5Paragraph 5
586. Decision following referral to appeal panel
587. 6Paragraph 6
588. Meaning of “working day”
589. 7Paragraph 7
590. Schedule 6: The applied GDPR and the applied Chapter 2 Repealed
591. Part 1: Modifications to the GDPR Repealed
592. Introductory Repealed
593. 1Paragraph 1 Repealed
594. References to the GDPR and its provisions Repealed
595. 2Paragraph 2 Repealed
596. References to Union law and Member State law Repealed
597. 3Paragraph 3 Repealed
598. References to the Union and to Member States Repealed
599. 4Paragraph 4 Repealed
600. References to supervisory authorities Repealed
601. 5Paragraph 5 Repealed
602. References to the national parliament Repealed
603. 6Paragraph 6 Repealed
604. Chapter I of the GDPR (general provisions) Repealed
605. 7Paragraph 7 Repealed
606. 8Paragraph 8 Repealed
607. 9Paragraph 9 Repealed
608. Chapter II of the GDPR (principles) Repealed
609. 10Paragraph 10 Repealed
610. 11Paragraph 11 Repealed
611. 12Paragraph 12 Repealed
612. 13Paragraph 13 Repealed
613. Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities) Repealed
614. 14Paragraph 14 Repealed
615. Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data) Repealed
616. 15Paragraph 15 Repealed
617. 16Paragraph 16 Repealed
618. Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure) Repealed
619. 17Paragraph 17 Repealed
620. 18Paragraph 18 Repealed
621. Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making) Repealed
622. 19Paragraph 19 Repealed
623. 20Paragraph 20 Repealed
624. Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions) Repealed
625. 21Paragraph 21 Repealed
626. Section 1 of Chapter IV of the GDPR (controller and processor: general obligations) Repealed
627. 22Paragraph 22 Repealed
628. 23Paragraph 23 Repealed
629. 24Paragraph 24 Repealed
630. 25Paragraph 25 Repealed
631. 26Paragraph 26 Repealed
632. Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation) Repealed
633. 27Paragraph 27 Repealed
634. 28Paragraph 28 Repealed
635. Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer) Repealed
636. 29Paragraph 29 Repealed
637. 30Paragraph 30 Repealed
638. Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification) Repealed
639. 31Paragraph 31 Repealed
640. 32Paragraph 32 Repealed
641. 33Paragraph 33 Repealed
642. 34Paragraph 34 Repealed
643. Chapter V of the GDPR (transfers of data to third countries or international organisations) Repealed
644. 35Paragraph 35 Repealed
645. 36Paragraph 36 Repealed
646. 37Paragraph 37 Repealed
647. 38Paragraph 38 Repealed
648. 39Paragraph 39 Repealed
649. Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status) Repealed
650. 40Paragraph 40 Repealed
651. 41Paragraph 41 Repealed
652. 42Paragraph 42 Repealed
653. 43Paragraph 43 Repealed
654. Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers) Repealed
655. 44Paragraph 44 Repealed
656. 45Paragraph 45 Repealed
657. 46Paragraph 46 Repealed
658. 47Paragraph 47 Repealed
659. 48Paragraph 48 Repealed
660. Chapter VII of the GDPR (co-operation and consistency) Repealed
661. 49Paragraph 49 Repealed
662. Chapter VIII of the GDPR (remedies, liability and penalties) Repealed
663. 50Paragraph 50 Repealed
664. 51Paragraph 51 Repealed
665. 52Paragraph 52 Repealed
666. 53Paragraph 53 Repealed
667. 54Paragraph 54 Repealed
668. 55Paragraph 55 Repealed
669. 56Paragraph 56 Repealed
670. 57Paragraph 57 Repealed
671. Chapter IX of the GDPR (provisions relating to specific processing situations) Repealed
672. 58Paragraph 58 Repealed
673. 59Paragraph 59 Repealed
674. 60Paragraph 60 Repealed
675. 61Paragraph 61 Repealed
676. 62Paragraph 62 Not yet in force
677. 63Paragraph 63 Repealed
678. 64Paragraph 64 Repealed
679. Chapter X of the GDPR (delegated acts and implementing acts) Repealed
680. 65Paragraph 65 Repealed
681. 66Paragraph 66 Repealed
682. Chapter XI of the GDPR (final provisions) Repealed
683. 67Paragraph 67 Repealed
684. 68Paragraph 68 Repealed
685. 69Paragraph 69 Repealed
686. 70Paragraph 70 Repealed
687. 71Paragraph 71 Repealed
688. 72Paragraph 72 Repealed
689. Part 2: Modifications to Chapter 2 of Part 2 Repealed
690. Introductory Repealed
691. 73Paragraph 73 Repealed
692. General modifications Repealed
693. 74Paragraph 74 Repealed
694. Exemptions Repealed
695. 75Paragraph 75 Repealed
696. Schedule 7: Competent authorities
697. 1Paragraph 1
698. 2Paragraph 2
699. 3Paragraph 3
700. 4Paragraph 4
701. Chief officers of police and other policing bodies
702. 5Paragraph 5
703. 6Paragraph 6
704. 7Paragraph 7
705. 8Paragraph 8
706. 9Paragraph 9
707. 10Paragraph 10
708. 11Paragraph 11
709. 12Paragraph 12
710. 13Paragraph 13
711. 14Paragraph 14
712. 15Paragraph 15
713. 15AParagraph 15A
714. 16Paragraph 16
715. 17Paragraph 17
716. 18Paragraph 18
717. 18AParagraph 18A
718. 19Paragraph 19
719. 20Paragraph 20
720. Other authorities with investigatory functions
721. 21Paragraph 21
722. 22Paragraph 22
723. 23Paragraph 23
724. 24Paragraph 24
725. 25Paragraph 25
726. 26Paragraph 26
727. 27Paragraph 27
728. 28Paragraph 28
729. 29Paragraph 29
730. 30Paragraph 30
731. 31Paragraph 31
732. 32Paragraph 32
733. 33Paragraph 33
734. 34Paragraph 34
735. 35Paragraph 35
736. Authorities with functions relating to offender management
737. 36Paragraph 36
738. 37Paragraph 37
739. 38Paragraph 38
740. 39Paragraph 39
741. 40Paragraph 40
742. 41Paragraph 41
743. 42Paragraph 42
744. 43Paragraph 43
745. 44Paragraph 44
746. 45Paragraph 45
747. 46Paragraph 46
748. Other authorities
749. 47Paragraph 47
750. 48Paragraph 48
751. 49Paragraph 49
752. 50Paragraph 50
753. 51Paragraph 51
754. 51AParagraph 51A
755. 52Paragraph 52 Repealed
756. 53Paragraph 53
757. 54Paragraph 54
758. 55Paragraph 55
759. 56Paragraph 56
760. 57Paragraph 57
761. Schedule 8: Conditions for sensitive processing under Part 3
762. Statutory etc purposes
763. 1Paragraph 1
764. Administration of justice
765. 2Paragraph 2
766. Protecting individual's vital interests
767. 3Paragraph 3
768. Safeguarding of children and of individuals at risk
769. 4Paragraph 4
770. Personal data already in the public domain
771. 5Paragraph 5
772. Legal claims
773. 6Paragraph 6
774. Judicial acts
775. 7Paragraph 7
776. Preventing fraud
777. 8Paragraph 8
778. Archiving etc
779. 9Paragraph 9
780. Schedule 9: Conditions for processing under Part 4
781. 1Paragraph 1
782. 2Paragraph 2
783. 3Paragraph 3
784. 4Paragraph 4
785. 5Paragraph 5
786. 6Paragraph 6
787. Schedule 10: Conditions for sensitive processing under Part 4
788. Consent to particular processing
789. 1Paragraph 1
790. Right or obligation relating to employment
791. 2Paragraph 2
792. Vital interests of a person
793. 3Paragraph 3
794. Safeguarding of children and of individuals at risk
795. 4Paragraph 4
796. Data already published by data subject
797. 5Paragraph 5
798. Legal proceedings etc
799. 6Paragraph 6
800. Administration of justice, parliamentary, statutory etc and government purposes
801. 7Paragraph 7
802. Medical purposes
803. 8Paragraph 8
804. Equality
805. 9Paragraph 9
806. Schedule 11: Other exemptions under Part 4
807. Preliminary
808. 1Paragraph 1
809. Crime
810. 2Paragraph 2
811. Information required to be disclosed by law etc or in connection with legal proceedings
812. 3Paragraph 3
813. Parliamentary privilege
814. 4Paragraph 4
815. Judicial proceedings
816. 5Paragraph 5
817. Crown honours and dignities
818. 6Paragraph 6
819. Armed forces
820. 7Paragraph 7
821. Economic well-being
822. 8Paragraph 8
823. Legal professional privilege
824. 9Paragraph 9
825. Negotiations
826. 10Paragraph 10
827. Confidential references given by the controller
828. 11Paragraph 11
829. Exam scripts and marks
830. 12Paragraph 12
831. Research and statistics
832. 13Paragraph 13
833. Archiving in the public interest
834. 14Paragraph 14
835. Schedule 12: The Information Commissioner Repealed
836. Status and capacity Repealed
837. 1Paragraph 1 Repealed
838. Appointment Repealed
839. 2Paragraph 2 Repealed
840. Resignation and removal Repealed
841. 3Paragraph 3 Repealed
842. Salary etc Repealed
843. 4Paragraph 4 Repealed
844. Officers and staff Repealed
845. 5Paragraph 5 Repealed
846. Carrying out of the Commissioner's functions by officers and staff Repealed
847. 6Paragraph 6 Repealed
848. Authentication of the seal of the Commissioner Repealed
849. 7Paragraph 7 Repealed
850. Presumption of authenticity of documents issued by the Commissioner Repealed
851. 8Paragraph 8 Repealed
852. Money Repealed
853. 9Paragraph 9 Repealed
854. Fees etc and other sums Repealed
855. 10Paragraph 10 Repealed
856. Accounts Repealed
857. 11Paragraph 11 Repealed
858. Scotland Repealed
859. 12Paragraph 12 Repealed
860. Schedule 12A: The Information Commission
861. 1Status
862. 2Number of members
863. 3Membership: general
864. 4Membership: non-executive members to outnumber executive members
865. 5Membership: selection on merit etc
866. 6Membership: conflicts of interests
867. 7Tenure of the chair
868. 8Tenure of deputy chair
869. 9Tenure of the other non-executive members
870. 10Remuneration and pensions of non-executive members
871. 11Executive members: terms and conditions
872. 12Other staff: appointment, terms and conditions
873. 13Committees
874. 14Delegation of functions
875. 15Advice from committees
876. 16Proceedings
877. 17Records of proceedings
878. 18Disqualification for acting in relation to certain matters
879. 19Validity of proceedings
880. 20Money
881. 21Fees etc and other sums
882. 22Accounts
883. 23Authentication of seal and presumption of authenticity of documents
884. 24Supplementary powers
885. 25Transitional provision: interim chief executive
886. 26Interpretation
887. Schedule 13: Other general functions of the Commission
888. General tasks
889. 1Paragraph 1
890. General powers
891. 2Paragraph 2
892. Definitions
893. 3Paragraph 3
894. Schedule 14: Co-operation and mutual assistance
895. Part 1: Law Enforcement Directive Repealed
896. Co-operation Repealed
897. 1Paragraph 1 Repealed
898. Requests for information and assistance from LED supervisory authorities Repealed
899. 2Paragraph 2 Repealed
900. Fees Repealed
901. 3Paragraph 3 Repealed
902. Restrictions on use of information Repealed
903. 4Paragraph 4 Repealed
904. LED supervisory authority Repealed
905. 5Paragraph 5 Repealed
906. Part 2: Data Protection Convention
907. Co-operation between the Commission and foreign designated authorities
908. 6Paragraph 6
909. Assisting persons resident outside the UK with requests under Article 14 of the Convention
910. 7Paragraph 7
911. Assisting UK residents with requests under Article 8 of the Convention
912. 8Paragraph 8
913. Restrictions on use of information
914. 9Paragraph 9
915. Foreign designated authority
916. 10Paragraph 10
917. Schedule 15: Powers of entry and inspection
918. Issue of warrants in connection with non-compliance and offences
919. 1Paragraph 1
920. Issue of warrants in connection with assessment notices
921. 2Paragraph 2
922. Restrictions on issuing warrants: processing for the special purposes
923. 3Paragraph 3
924. Restrictions on issuing warrants: procedural requirements
925. 4Paragraph 4
926. Content of warrants
927. 5Paragraph 5
928. Copies of warrants
929. 6Paragraph 6
930. Execution of warrants: reasonable force
931. 7Paragraph 7
932. Execution of warrants: time when executed
933. 8Paragraph 8
934. Execution of warrants: occupier of premises
935. 9Paragraph 9
936. Execution of warrants: seizure of documents etc
937. 10Paragraph 10
938. Matters exempt from inspection and seizure: privileged communications
939. 11Paragraph 11
940. Matters exempt from inspection and seizure: Parliamentary privilege
941. 12Paragraph 12
942. Partially exempt material
943. 13Paragraph 13
944. Return of warrants
945. 14Paragraph 14
946. Offences
947. 15Paragraph 15
948. Self-incrimination
949. 16Paragraph 16
950. Vessels, vehicles etc
951. 17Paragraph 17
952. Scotland
953. 18Paragraph 18
954. Northern Ireland
955. 19Paragraph 19
956. Schedule 16: Penalties
957. Meaning of “penalty”
958. 1Paragraph 1
959. Notice of intent to impose penalty
960. 2Paragraph 2
961. Contents of notice of intent
962. 3Paragraph 3
963. Giving a penalty notice
964. 4Paragraph 4
965. Contents of penalty notice
966. 5Paragraph 5
967. Period for payment of penalty
968. 6Paragraph 6
969. Variation of penalty
970. 7Paragraph 7
971. Cancellation of penalty
972. 8Paragraph 8
973. Enforcement of payment
974. 9Paragraph 9
975. Schedule 17: Review of processing of personal data for the purposes of journalism
976. Interpretation
977. 1Paragraph 1
978. Information notices
979. 2Paragraph 2
980. Assessment notices
981. 3Paragraph 3
982. Interview notices
983. 3AParagraph 3A
984. Applications in respect of urgent notices
985. 4Paragraph 4
986. Schedule 18: Relevant records
987. Relevant records
988. 1Paragraph 1
989. Relevant health records
990. 2Paragraph 2
991. Relevant records relating to a conviction or caution
992. 3Paragraph 3
993. Relevant records relating to statutory functions
994. 4Paragraph 4
995. Data subject access right
996. 5Paragraph 5
997. Records stating that personal data is not processed
998. 6Paragraph 6
999. Power to amend
1000. 7Paragraph 7
1001. Schedule 19: Minor and consequential amendments
1002. Part 1: Amendments of primary legislation
1003. Registration Service Act 1953 (c. 37)
1004. 1Paragraph 1
1005. Veterinary Surgeons Act 1966 (c. 36)
1006. 2Paragraph 2
1007. Parliamentary Commissioner Act 1967 (c. 13)
1008. 3Paragraph 3
1009. Local Government Act 1974 (c. 7)
1010. 4Paragraph 4
1011. 5Paragraph 5
1012. 6Paragraph 6
1013. Consumer Credit Act 1974 (c. 39)
1014. 7Paragraph 7
1015. 8Paragraph 8
1016. 9Paragraph 9
1017. 10Paragraph 10
1018. Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))
1019. 11Paragraph 11
1020. 12Paragraph 12
1021. 13Paragraph 13
1022. 14Paragraph 14
1023. 15Paragraph 15
1024. 16Paragraph 16
1025. 17Paragraph 17
1026. Representation of the People Act 1983 (c. 2)
1027. 18Paragraph 18
1028. Medical Act 1983 (c. 54)
1029. 19Paragraph 19
1030. 20Paragraph 20
1031. 21Paragraph 21
1032. 22Paragraph 22
1033. 23Paragraph 23
1034. 24Paragraph 24
1035. 25Paragraph 25
1036. 26Paragraph 26
1037. Dentists Act 1984 (c. 24)
1038. 27Paragraph 27
1039. 28Paragraph 28
1040. 29Paragraph 29
1041. 30Paragraph 30
1042. 31Paragraph 31
1043. 32Paragraph 32
1044. Companies Act 1985 (c. 6)
1045. 33Paragraph 33
1046. Access to Medical Reports Act 1988 (c. 28)
1047. 34Paragraph 34
1048. Opticians Act 1989 (c. 44)
1049. 35Paragraph 35
1050. Access to Health Records Act 1990 (c. 23)
1051. 36Paragraph 36
1052. 37Paragraph 37
1053. 38Paragraph 38
1054. Human Fertilisation and Embryology Act 1990 (c. 37)
1055. 39Paragraph 39
1056. Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)
1057. 40Paragraph 40
1058. Tribunals and Inquiries Act 1992 (c. 53)
1059. 41Paragraph 41
1060. Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))
1061. 42Paragraph 42
1062. Health Service Commissioners Act 1993 (c. 46)
1063. 43Paragraph 43
1064. Data Protection Act 1998 (c. 29)
1065. 44Paragraph 44
1066. Crime and Disorder Act 1998 (c. 37)
1067. 45Paragraph 45
1068. Food Standards Act 1999 (c. 28)
1069. 46Paragraph 46
1070. Immigration and Asylum Act 1999 (c. 33)
1071. 47Paragraph 47
1072. Financial Services and Markets Act 2000 (c. 8)
1073. 48Paragraph 48
1074. 49Paragraph 49 Repealed
1075. 50Paragraph 50
1076. 51Paragraph 51
1077. 52Paragraph 52
1078. 53Paragraph 53
1079. Terrorism Act 2000 (c. 11)
1080. 54Paragraph 54
1081. Freedom of Information Act 2000 (c. 36)
1082. 55Paragraph 55
1083. 56Paragraph 56
1084. 57Paragraph 57
1085. 58Paragraph 58
1086. 59Paragraph 59
1087. 60Paragraph 60
1088. 61Paragraph 61
1089. 62Paragraph 62
1090. 63Paragraph 63
1091. 64Paragraph 64
1092. Political Parties, Elections and Referendums Act 2000 (c. 41)
1093. 65Paragraph 65
1094. Public Finance and Accountability (Scotland) Act 2000 (asp 1)
1095. 66Paragraph 66
1096. 67Paragraph 67
1097. 68Paragraph 68
1098. 69Paragraph 69
1099. Criminal Justice and Police Act 2001 (c. 16)
1100. 70Paragraph 70
1101. 71Paragraph 71
1102. 72Paragraph 72
1103. 73Paragraph 73
1104. Anti-terrorism, Crime and Security Act 2001 (c.24)
1105. 74Paragraph 74
1106. 75Paragraph 75
1107. 76Paragraph 76 Not yet in force
1108. Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))
1109. 77Paragraph 77
1110. Justice (Northern Ireland) Act 2002 (c. 26)
1111. 78Paragraph 78
1112. Proceeds of Crime Act 2002 (c. 29)
1113. 79Paragraph 79
1114. 80Paragraph 80
1115. 81Paragraph 81
1116. 82Paragraph 82
1117. 83Paragraph 83
1118. 84Paragraph 84
1119. 85Paragraph 85
1120. Enterprise Act 2002 (c. 40)
1121. 86Paragraph 86
1122. Scottish Public Services Ombudsman Act 2002 (asp 11)
1123. 87Paragraph 87
1124. Freedom of Information (Scotland) Act 2002 (asp 13)
1125. 88Paragraph 88
1126. 89Paragraph 89
1127. 90Paragraph 90
1128. Courts Act 2003 (c. 39)
1129. 91Paragraph 91
1130. 92Paragraph 92
1131. 93Paragraph 93
1132. Sexual Offences Act 2003 (c. 42)
1133. 94Paragraph 94
1134. Criminal Justice Act 2003 (c. 44)
1135. 95Paragraph 95
1136. 96Paragraph 96
1137. 97Paragraph 97
1138. Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)
1139. 98Paragraph 98
1140. Public Audit (Wales) Act 2004 (c. 23)
1141. 99Paragraph 99
1142. Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)
1143. 100Paragraph 100
1144. 101Paragraph 101
1145. 102Paragraph 102
1146. Domestic Violence, Crime and Victims Act 2004 (c. 28)
1147. 103Paragraph 103
1148. Children Act 2004 (c. 31)
1149. 104Paragraph 104
1150. 105Paragraph 105
1151. 106Paragraph 106
1152. Constitutional Reform Act 2005 (c. 4)
1153. 107Paragraph 107
1154. Mental Capacity Act 2005 (c. 9)
1155. 108Paragraph 108
1156. Public Services Ombudsman (Wales) Act 2005 (c. 10)
1157. 109Paragraph 109
1158. Commissioners for Revenue and Customs Act 2005 (c. 11)
1159. 110Paragraph 110
1160. Gambling Act 2005 (c. 19)
1161. 111Paragraph 111
1162. Commissioner for Older People (Wales) Act 2006 (c. 30)
1163. 112Paragraph 112
1164. National Health Service Act 2006 (c. 41)
1165. 113Paragraph 113
1166. 114Paragraph 114
1167. 115Paragraph 115
1168. 116Paragraph 116
1169. National Health Service (Wales) Act 2006 (c. 42)
1170. 117Paragraph 117
1171. 118Paragraph 118
1172. 119Paragraph 119
1173. Companies Act 2006 (c. 46)
1174. 120Paragraph 120
1175. 121Paragraph 121
1176. 122Paragraph 122
1177. 123Paragraph 123
1178. 124Paragraph 124
1179. 125Paragraph 125
1180. 126Paragraph 126
1181. 127Paragraph 127
1182. 128Paragraph 128
1183. 129Paragraph 129
1184. Tribunals, Courts and Enforcement Act 2007 (c. 15)
1185. 130Paragraph 130
1186. 131Paragraph 131
1187. 132Paragraph 132
1188. Statistics and Registration Service Act 2007 (c. 18)
1189. 133Paragraph 133
1190. 134Paragraph 134
1191. 135Paragraph 135
1192. 136Paragraph 136
1193. 137Paragraph 137
1194. 138Paragraph 138
1195. 139Paragraph 139
1196. 140Paragraph 140
1197. 141Paragraph 141
1198. 142Paragraph 142
1199. Serious Crime Act 2007 (c. 27)
1200. 143Paragraph 143
1201. 144Paragraph 144
1202. 145Paragraph 145
1203. 146Paragraph 146
1204. Legal Services Act 2007 (c. 29)
1205. 147Paragraph 147
1206. Adoption and Children (Scotland) Act 2007 (asp 4)
1207. 148Paragraph 148
1208. Criminal Justice and Immigration Act 2008 (c. 4)
1209. 149Paragraph 149
1210. 150Paragraph 150
1211. 151Paragraph 151
1212. Regulatory Enforcement and Sanctions Act 2008 (c. 13)
1213. 152Paragraph 152
1214. Health and Social Care Act 2008 (c. 14)
1215. 153Paragraph 153
1216. Counter-Terrorism Act 2008 (c. 28)
1217. 154Paragraph 154
1218. Public Health etc. (Scotland) Act 2008 (asp 5)
1219. 155Paragraph 155
1220. Banking Act 2009 (c. 1)
1221. 156Paragraph 156
1222. Borders, Citizenship and Immigration Act 2009 (c. 11)
1223. 157Paragraph 157
1224. Marine and Coastal Access Act 2009 (c. 23)
1225. 158Paragraph 158
1226. 159Paragraph 159
1227. 160Paragraph 160
1228. Coroners and Justice Act 2009 (c. 25)
1229. 161Paragraph 161
1230. Broads Authority Act 2009 (c. i)
1231. 162Paragraph 162
1232. Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))
1233. 163Paragraph 163
1234. Terrorist Asset-Freezing etc. Act 2010 (c. 38)
1235. 164Paragraph 164
1236. Marine (Scotland) Act 2010 (asp 5)
1237. 165Paragraph 165
1238. Charities Act 2011 (c. 25)
1239. 166Paragraph 166
1240. Welsh Language (Wales) Measure 2011 (nawm 1)
1241. 167Paragraph 167
1242. 168Paragraph 168
1243. 169Paragraph 169
1244. Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))
1245. 170Paragraph 170
1246. Health and Social Care Act 2012 (c. 7)
1247. 171Paragraph 171
1248. 172Paragraph 172
1249. 173Paragraph 173
1250. 174Paragraph 174
1251. Protection of Freedoms Act 2012 (c. 9)
1252. 175Paragraph 175
1253. 176Paragraph 176
1254. 177Paragraph 177
1255. 178Paragraph 178
1256. HGV Road User Levy Act 2013 (c. 7)
1257. 179Paragraph 179
1258. Crime and Courts Act 2013 (c. 22)
1259. 180Paragraph 180
1260. 181Paragraph 181
1261. 182Paragraph 182
1262. Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))
1263. 183Paragraph 183
1264. Local Audit and Accountability Act 2014 (c. 2)
1265. 184Paragraph 184
1266. Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)
1267. 185Paragraph 185
1268. Immigration Act 2014 (c. 22)
1269. 186Paragraph 186
1270. Care Act 2014 (c. 23)
1271. 187Paragraph 187
1272. Social Services and Well-being (Wales) Act 2014 (anaw 4)
1273. 188Paragraph 188
1274. Counter-Terrorism and Security Act 2015 (c. 6)
1275. 189Paragraph 189
1276. Small Business, Enterprise and Employment Act 2015 (c. 26)
1277. 190Paragraph 190
1278. Modern Slavery Act 2015 (c. 30)
1279. 191Paragraph 191 Repealed
1280. Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))
1281. 192Paragraph 192
1282. 193Paragraph 193
1283. 194Paragraph 194
1284. 195Paragraph 195
1285. Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))
1286. 196Paragraph 196
1287. Immigration Act 2016 (c. 19)
1288. 197Paragraph 197 Repealed
1289. Investigatory Powers Act 2016 (c. 25)
1290. 198Paragraph 198
1291. 199Paragraph 199
1292. 200Paragraph 200
1293. 201Paragraph 201 Not yet in force
1294. 202Paragraph 202
1295. 203Paragraph 203
1296. Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))
1297. 204Paragraph 204
1298. Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))
1299. 205Paragraph 205
1300. Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))
1301. 206Paragraph 206
1302. Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))
1303. 207Paragraph 207
1304. 208Paragraph 208
1305. 209Paragraph 209
1306. Policing and Crime Act 2017 (c. 3)
1307. 210Paragraph 210
1308. Children and Social Work Act 2017 (c. 12)
1309. 211Paragraph 211
1310. Higher Education and Research Act 2017 (c. 29)
1311. 212Paragraph 212
1312. 213Paragraph 213
1313. 214Paragraph 214
1314. Digital Economy Act 2017 (c. 30)
1315. 215Paragraph 215
1316. 216Paragraph 216
1317. 217Paragraph 217
1318. 218Paragraph 218
1319. 219Paragraph 219
1320. 220Paragraph 220
1321. 221Paragraph 221
1322. 222Paragraph 222
1323. 223Paragraph 223
1324. 224Paragraph 224
1325. Landfill Disposals Tax (Wales) Act 2017 (anaw 3)
1326. 225Paragraph 225
1327. Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)
1328. 226Paragraph 226
1329. This Act
1330. 227Paragraph 227
1331. Part 2: Amendments of other legislation
1332. Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)
1333. 228Paragraph 228
1334. Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)
1335. 229Paragraph 229
1336. Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
1337. 230Paragraph 230
1338. 231Paragraph 231
1339. 232Paragraph 232
1340. Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)
1341. 233Paragraph 233
1342. European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)
1343. 234Paragraph 234
1344. 235Paragraph 235
1345. 236Paragraph 236
1346. Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)
1347. 237Paragraph 237
1348. Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)
1349. 238Paragraph 238
1350. Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)
1351. 239Paragraph 239
1352. Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)
1353. 240Paragraph 240
1354. Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)
1355. 241Paragraph 241
1356. Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)
1357. 242Paragraph 242
1358. Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)
1359. 243Paragraph 243
1360. Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)
1361. 244Paragraph 244
1362. Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)
1363. 245Paragraph 245
1364. Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)
1365. 246Paragraph 246
1366. Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)
1367. 247Paragraph 247
1368. Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)
1369. 248Paragraph 248
1370. Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)
1371. 249Paragraph 249
1372. Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)
1373. 250Paragraph 250
1374. Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)
1375. 251Paragraph 251
1376. Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)
1377. 252Paragraph 252
1378. 253Paragraph 253
1379. 254Paragraph 254
1380. 255Paragraph 255
1381. 256Paragraph 256
1382. 257Paragraph 257
1383. 258Paragraph 258
1384. 259Paragraph 259
1385. 260Paragraph 260
1386. 261Paragraph 261
1387. 262Paragraph 262
1388. 263Paragraph 263
1389. 264Paragraph 264
1390. Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)
1391. 265Paragraph 265
1392. 266Paragraph 266
1393. 267Paragraph 267
1394. 268Paragraph 268
1395. 269Paragraph 269
1396. 270Paragraph 270
1397. 271Paragraph 271
1398. 272Paragraph 272
1399. 273Paragraph 273
1400. 274Paragraph 274
1401. 275Paragraph 275
1402. 276Paragraph 276
1403. 277Paragraph 277
1404. Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)
1405. 278Paragraph 278
1406. Nursing and Midwifery Order 2001 (S.I. 2002/253)
1407. 279Paragraph 279
1408. 280Paragraph 280
1409. 281Paragraph 281
1410. 282Paragraph 282
1411. 283Paragraph 283
1412. 284Paragraph 284
1413. 285Paragraph 285
1414. 286Paragraph 286
1415. Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)
1416. 287Paragraph 287
1417. 288Paragraph 288
1418. 289Paragraph 289
1419. Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)
1420. 290Paragraph 290
1421. Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)
1422. 291Paragraph 291
1423. 292Paragraph 292
1424. 293Paragraph 293
1425. Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)
1426. 294Paragraph 294
1427. 295Paragraph 295
1428. 296Paragraph 296
1429. Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)
1430. 297Paragraph 297
1431. 298Paragraph 298
1432. 299Paragraph 299
1433. 300Paragraph 300
1434. European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)
1435. 301Paragraph 301
1436. 302Paragraph 302
1437. 303Paragraph 303
1438. Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)
1439. 304Paragraph 304
1440. Environmental Information Regulations 2004 (S.I. 2004/3391)
1441. 305Paragraph 305
1442. 306Paragraph 306
1443. 307Paragraph 307
1444. 308Paragraph 308
1445. 309Paragraph 309
1446. Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
1447. 310Paragraph 310
1448. 311Paragraph 311
1449. 312Paragraph 312
1450. Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)
1451. 313Paragraph 313
1452. Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)
1453. 314Paragraph 314
1454. 315Paragraph 315
1455. 316Paragraph 316
1456. Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)
1457. 317Paragraph 317
1458. Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)
1459. 318Paragraph 318
1460. Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)
1461. 319Paragraph 319
1462. 320Paragraph 320
1463. Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)
1464. 321Paragraph 321
1465. National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)
1466. 322Paragraph 322
1467. Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)
1468. 323Paragraph 323
1469. National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)
1470. 324Paragraph 324
1471. Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))
1472. 325Paragraph 325
1473. Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)
1474. 326Paragraph 326
1475. Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)
1476. 327Paragraph 327
1477. Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)
1478. 328Paragraph 328
1479. 329Paragraph 329
1480. 330Paragraph 330
1481. Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)
1482. 331Paragraph 331
1483. Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)
1484. 332Paragraph 332
1485. Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))
1486. 333Paragraph 333
1487. 334Paragraph 334
1488. 335Paragraph 335
1489. 336Paragraph 336
1490. 337Paragraph 337
1491. Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)
1492. 338Paragraph 338
1493. Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)
1494. 339Paragraph 339
1495. Overseas Companies Regulations 2009 (S.I. 2009/1801)
1496. 340Paragraph 340
1497. Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)
1498. 341Paragraph 341
1499. Provision of Services Regulations 2009 (S.I. 2009/2999)
1500. 342Paragraph 342
1501. INSPIRE Regulations 2009 (S.I. 2009/3157)
1502. 343Paragraph 343
1503. INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)
1504. 344Paragraph 344
1505. Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)
1506. 345Paragraph 345
1507. 346Paragraph 346
1508. 347Paragraph 347
1509. 348Paragraph 348
1510. 349Paragraph 349
1511. Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)
1512. 350Paragraph 350
1513. Pharmacy Order 2010 (S.I. 2010/231)
1514. 351Paragraph 351
1515. 352Paragraph 352
1516. 353Paragraph 353
1517. 354Paragraph 354
1518. 355Paragraph 355
1519. 356Paragraph 356
1520. 357Paragraph 357
1521. 358Paragraph 358
1522. 359Paragraph 359
1523. Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)
1524. 360Paragraph 360
1525. National Employment Savings Trust Order 2010 (S.I. 2010/917)
1526. 361Paragraph 361
1527. 362Paragraph 362
1528. 363Paragraph 363
1529. Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)
1530. 364Paragraph 364
1531. Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))
1532. 365Paragraph 365
1533. Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)
1534. 366Paragraph 366
1535. Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)
1536. 367Paragraph 367
1537. 368Paragraph 368
1538. 369Paragraph 369
1539. Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)
1540. 370Paragraph 370
1541. Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)
1542. 371Paragraph 371
1543. 372Paragraph 372
1544. 373Paragraph 373
1545. 374Paragraph 374
1546. 375Paragraph 375
1547. 376Paragraph 376
1548. 377Paragraph 377
1549. Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)
1550. 378Paragraph 378
1551. Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)
1552. 379Paragraph 379
1553. Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)
1554. 380Paragraph 380
1555. Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)
1556. 381Paragraph 381
1557. The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)
1558. 382Paragraph 382
1559. Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)
1560. 383Paragraph 383
1561. Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)
1562. 384Paragraph 384
1563. Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)
1564. 385Paragraph 385
1565. 386Paragraph 386
1566. 387Paragraph 387
1567. European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)
1568. 388Paragraph 388
1569. 389Paragraph 389
1570. 390Paragraph 390
1571. 391Paragraph 391
1572. 392Paragraph 392
1573. 393Paragraph 393
1574. 394Paragraph 394
1575. Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)
1576. 395Paragraph 395
1577. 396Paragraph 396
1578. 397Paragraph 397
1579. Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)
1580. 398Paragraph 398
1581. Register of People with Significant Control Regulations 2016 (S.I. 2016/339)
1582. 399Paragraph 399
1583. 400Paragraph 400
1584. 401Paragraph 401
1585. 402Paragraph 402
1586. Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)
1587. 403Paragraph 403
1588. 404Paragraph 404
1589. 405Paragraph 405
1590. 406Paragraph 406
1591. Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)
1592. 407Paragraph 407
1593. 408Paragraph 408
1594. 409Paragraph 409
1595. Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)
1596. 410Paragraph 410
1597. 411Paragraph 411
1598. 412Paragraph 412
1599. 413Paragraph 413
1600. 414Paragraph 414
1601. 415Paragraph 415
1602. 416Paragraph 416
1603. 417Paragraph 417
1604. 418Paragraph 418
1605. 419Paragraph 419
1606. Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)
1607. 420Paragraph 420
1608. Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)
1609. 421Paragraph 421
1610. National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)
1611. 422Paragraph 422
1612. 423Paragraph 423
1613. 424Paragraph 424
1614. 425Paragraph 425
1615. National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)
1616. 426Paragraph 426
1617. 427Paragraph 427
1618. 428Paragraph 428
1619. 429Paragraph 429
1620. Part 3: Modifications
1621. Introduction
1622. 430Paragraph 430
1623. General modifications
1624. 431Paragraph 431
1625. Specific modification of references to terms used in the Data Protection Act 1998
1626. 432Paragraph 432
1627. Part 4: Supplementary
1628. Definitions
1629. 433Paragraph 433
1630. Provision inserted in subordinate legislation by this Schedule
1631. 434Paragraph 434
1632. Schedule 20: Transitional provision etc
1633. Part 1: General
1634. Interpretation
1635. 1Paragraph 1
1636. Part 2: Rights of data subjects
1637. Right of access to personal data under the 1998 Act
1638. 2Paragraph 2
1639. Right to prevent processing likely to cause damage or distress under the 1998 Act
1640. 3Paragraph 3
1641. Right to prevent processing for purposes of direct marketing under the 1998 Act
1642. 4Paragraph 4
1643. Automated processing under the 1998 Act
1644. 5Paragraph 5
1645. Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations
1646. 6Paragraph 6
1647. Rectification, blocking, erasure and destruction under the 1998 Act
1648. 7Paragraph 7
1649. Jurisdiction and procedure under the 1998 Act
1650. 8Paragraph 8
1651. Exemptions under the 1998 Act
1652. 9Paragraph 9
1653. Prohibition by this Act of requirement to produce relevant records
1654. 10Paragraph 10
1655. Avoidance under this Act of certain contractual terms relating to health records
1656. 11Paragraph 11
1657. Part 3: The UK GDPR and Part 2 of this Act
1658. Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR
1659. 12Paragraph 12
1660. Manual unstructured data held by FOI public authorities
1661. 13Paragraph 13
1662. Part 4: Law enforcement and intelligence services processing
1663. Logging
1664. 14Paragraph 14
1665. Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)
1666. 15Paragraph 15
1667. Maximum fee for data subject access requests to intelligence services
1668. 16Paragraph 16
1669. Part 5: National security certificates
1670. National security certificates: processing of personal data under the 1998 Act
1671. 17Paragraph 17
1672. National security certificates: processing of personal data under the 2018 Act
1673. 18Paragraph 18
1674. Part 6: The Information Commissioner
1675. Appointment etc
1676. 19Paragraph 19
1677. Accounts
1678. 20Paragraph 20
1679. Annual report
1680. 21Paragraph 21
1681. Fees etc received by the Commissioner
1682. 22Paragraph 22
1683. 23Paragraph 23
1684. Functions in connection with the Data Protection Convention
1685. 24Paragraph 24
1686. Co-operation with the European Commission: transfers of personal data outside the EEA
1687. 25Paragraph 25
1688. Charges payable to the Commissioner by controllers
1689. 26Paragraph 26
1690. Requests for assessment
1691. 27Paragraph 27
1692. Codes of practice
1693. 28Paragraph 28
1694. Part 7: Enforcement etc under the 1998 Act
1695. Interpretation of this Part
1696. 29Paragraph 29
1697. Information notices
1698. 30Paragraph 30
1699. Special information notices
1700. 31Paragraph 31
1701. Assessment notices
1702. 32Paragraph 32
1703. Enforcement notices
1704. 33Paragraph 33
1705. Determination by Commissioner as to the special purposes
1706. 34Paragraph 34
1707. Restriction on enforcement in case of processing for the special purposes
1708. 35Paragraph 35
1709. Offences
1710. 36Paragraph 36
1711. Powers of entry
1712. 37Paragraph 37
1713. Monetary penalties
1714. 38Paragraph 38
1715. Appeals
1716. 39Paragraph 39
1717. Exemptions
1718. 40Paragraph 40
1719. Tribunal Procedure Rules
1720. 41Paragraph 41
1721. Obstruction etc
1722. 42Paragraph 42
1723. Enforcement etc under the 2014 Regulations
1724. 43Paragraph 43
1725. Part 8: Enforcement etc under this Act
1726. Information notices
1727. 44Paragraph 44
1728. Powers of entry
1729. 45Paragraph 45
1730. Tribunal Procedure Rules
1731. 46Paragraph 46
1732. Part 9: Other enactments
1733. Powers to disclose information to the Commissioner
1734. 47Paragraph 47
1735. Codes etc required to be consistent with the Commissioner's data-sharing code
1736. 48Paragraph 48
1737. 49Paragraph 49
1738. Consumer Credit Act 1974
1739. 50Paragraph 50
1740. Freedom of Information Act 2000
1741. 51Paragraph 51
1742. 52Paragraph 52
1743. 53Paragraph 53
1744. 54Paragraph 54
1745. 55Paragraph 55
1746. Freedom of Information (Scotland) Act 2002
1747. 56Paragraph 56
1748. Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
1749. 57Paragraph 57
1750. Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)
1751. 58Paragraph 58
1752. Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))
1753. 59Paragraph 59
1754. Environmental Information Regulations 2004 (S.I. 2004/3391)
1755. 60Paragraph 60
1756. Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
1757. 61Paragraph 61
1758. Schedule 21: Further transitional provision etc
1759. Part 1: Interpretation
1760. 1The applied GPDR
1761. Part 2: Continuation of existing acts etc
1762. 2Merger of the directly applicable GDPR and the applied GDPR
1763. 3Paragraph 3
1764. Part 3: Transfers to third countries and international organisations
1765. 4UK GDPR: transfers approved by regulations
1766. 5Paragraph 5
1767. 6Paragraph 6
1768. 7UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses Repealed
1769. 8Paragraph 8 Repealed
1770. 9UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules
1771. 10Part 3 (law enforcement processing): transfers approved by regulations
1772. 11Paragraph 11
1773. 12Paragraph 12
1774. Part 4: Repeal of provisions in Chapter 3 of Part 2
1775. 13Applied GDPR: power to make provision in consequence of GDPR regulations
1776. 14Applied GDPR: national security certificates
1777. Part 5: The Information Commission
1778. 15Confidentiality of information
1779. Part 6: Enforcement
1780. 16GDPR: maximum amount of penalties
1781. 17GDPR: right to an effective remedy against the Commissioner