Data Protection Act 2018 in Scotland

2018 c. 12 · Enacted 23 May 2018 · Extends to United Kingdom

Contents

1. Part 1: Preliminary
2. 1Overview
3. 2Protection of personal data
4. 3Terms relating to the processing of personal data
5. Part 2: General processing
6. Chapter 1: Scope and definitions
7. 4Processing to which this Part applies
8. 5Definitions
9. Chapter 2: The UK GDPR
10. Meaning of certain terms used in the UK GDPR
11. 6Meaning of “controller”
12. 7Meaning of “public authority” and “public body”
13. Lawfulness of processing
14. 8Lawfulness of processing: public interest etc
15. 9Child's consent in relation to information society services Repealed
16. Relevant international law
17. 9AProcessing in reliance on relevant international law
18. Special categories of personal data
19. 10Special categories of personal data and criminal convictions etc data
20. 11Special categories of personal data etc: supplementary
21. Rights of the data subject
22. 12Limits on fees that may be charged by controllers
23. 13Obligations of credit reference agencies
24. 13AMeaning of “relevant offence” for purpose of right to erasure
25. 14Automated decision-making authorised by law: safeguards Repealed
26. Exemptions etc
27. 15Exemptions etc
28. 16Power to make further exemptions etc by regulations
29. Certification
30. 17Accreditation of certification providers
31. ...
32. 17ATransfers based on adequacy regulations Repealed
33. 17BTransfers based on adequacy regulations: review etc Repealed
34. 17CStandard data protection clauses Repealed
35. 18Transfers of personal data to third countries etc : public interest Repealed
36. ...
37. 19Processing for archiving, research and statistical purposes: safeguards Repealed
38. Minor definition
39. 20Meaning of “court” Repealed
40. Chapter 3: Exemptions for manual unstructured processing and for national security and defence purposes
41. Definitions
42. 21Definitions
43. ...
44. 22Application of the GDPR to processing to which this Chapter applies Repealed
45. 23Power to make provision in consequence of regulations related to the GDPR Repealed
46. Exemptions etc
47. 24Manual unstructured data held by FOI public authorities
48. 25Manual unstructured data used in longstanding historical research
49. 26National security and defence exemption
50. 27National security: certificate
51. 28National security and defence: modifications to Articles 9 and 32 of the UK GDPR
52. Part 3: Law enforcement processing
53. Chapter 1: Scope and definitions
54. Scope
55. 29Processing to which this Part applies
56. Definitions
57. 30Meaning of “competent authority”
58. 31“The law enforcement purposes”
59. 32Meaning of “controller” and “processor”
60. 33Other definitions
61. Chapter 2: Principles
62. 34Overview and general duty of controller
63. 35The first data protection principle
64. 36The second data protection principle
65. 37The third data protection principle
66. 38The fourth data protection principle
67. 39The fifth data protection principle
68. 40The sixth data protection principle
69. 40AConditions for consent
70. 41Safeguards: archiving
71. 42Safeguards: sensitive processing
72. 42AFurther provision about sensitive processing
73. Chapter 3: Rights of the data subject
74. Overview and scope
75. 43Overview and scope
76. Data subject’s rights to information
77. 44... Controller's general duties
78. ...
79. 45Right of access by the data subject
80. 45AExemption from sections 44 and 45: legal professional privilege
81. Data subject's rights to rectification or erasure etc
82. 46Right to rectification
83. 47Right to erasure or restriction of processing
84. 48Rights under section 46 or 47: supplementary
85. Automated individual decision-making
86. 49Right not to be subject to automated decision-making Repealed
87. 50Automated decision-making authorised by law: safeguards Repealed
88. 50AAutomated processing and significant decisions
89. 50BRestrictions on automated decision-making based on sensitive processing
90. 50CSafeguards for automated decision-making
91. 50DFurther provision about automated decision-making
92. Supplementary
93. 51Exercise of rights through the Commission
94. 52Form of provision of information etc
95. 53Manifestly unfounded or excessive requests by the data subject
96. 54Meaning of “applicable time period”
97. Chapter 4: Controller and processor
98. Overview and scope
99. 55Overview and scope
100. General obligations
101. 56General obligations of the controller
102. 57Data protection by design and default
103. 58Joint controllers
104. 59Processors
105. 60Processing under the authority of the controller or processor
106. 61Records of processing activities
107. 62Logging
108. 63Co-operation with the Commission
109. 64Data protection impact assessment
110. 65Prior consultation with the Commission
111. Obligations relating to security
112. 66Security of processing
113. Obligations relating to personal data breaches
114. 67Notification of a personal data breach to the Commission
115. 68Communication of a personal data breach to the data subject
116. Data protection officers
117. 69Designation of a data protection officer
118. 70Position of data protection officer
119. 71Tasks of data protection officer
120. Codes of conduct
121. 71ACodes of conduct
122. Chapter 5: Transfers of personal data to third countries etc
123. Overview and interpretation
124. 72Overview and interpretation
125. General principles for transfers
126. 73General principles for transfers of personal data
127. 74Transfers on the basis of an adequacy decision Repealed
128. 74ATransfers based on adequacy regulations Repealed
129. 74AATransfers approved by regulations
130. 74ABThe data protection test
131. 74BTransfers approved by regulations: monitoring
132. 75Transfers subject to appropriate safeguards
133. 76Transfers based on special circumstances
134. Additional conditions
135. 77Additional conditions for transfers in reliance on section 73(4)(b)
136. Subsequent transfers
137. 78Subsequent transfers
138. Chapter 6: Supplementary
139. 78ANational security exemption
140. 79National security: certificate
141. 80Special processing restrictions
142. 81Reporting of infringements
143. Part 4: Intelligence services processing
144. Chapter 1: Scope and definitions
145. Scope
146. 82Processing to which this Part applies
147. 82ADesignation of processing by a qualifying competent authority
148. 82BDuration of designation notice
149. 82CReview and withdrawal of designation notice
150. 82DRecords of designation notices
151. 82EAppeal against designation notice
152. Definitions
153. 83Meaning of “controller” and “processor”
154. 84Other definitions
155. Chapter 2: Principles
156. Overview
157. 85Overview
158. The data protection principles
159. 86The first data protection principle
160. 87The second data protection principle
161. 88The third data protection principle
162. 89The fourth data protection principle
163. 90The fifth data protection principle
164. 91The sixth data protection principle
165. 91AFurther provision about sensitive processing
166. Chapter 3: Rights of the data subject
167. Overview
168. 92Overview
169. Rights
170. 93Right to information
171. 94Right of access
172. 95Right of access: supplementary
173. 96Right not to be subject to automated decision-making
174. 97Right to intervene in automated decision-making
175. 98Right to information about decision-making
176. 99Right to object to processing
177. 100Rights to rectification and erasure
178. Chapter 4: Controller and processor
179. Overview
180. 101Overview
181. General obligations
182. 102General obligations of the controller
183. 103Data protection by design
184. 104Joint controllers
185. 105Processors
186. 106Processing under the authority of the controller or processor
187. Obligations relating to security
188. 107Security of processing
189. Obligations relating to personal data breaches
190. 108Communication of a personal data breach
191. Chapter 5: Transfers of personal data outside the United Kingdom
192. 109Transfers of personal data outside the United Kingdom
193. Chapter 6: Exemptions
194. 110National security
195. 111National security: certificate
196. 112Other exemptions
197. 113Power to make further exemptions
198. Part 5: The Information Commission
199. ...
200. 114The Information Commissioner Repealed
201. The Information Commission
202. 114AThe Information Commission
203. General functions
204. 115General functions under the UK GDPR and safeguards
205. 116Other general functions
206. 117Competence in relation to courts etc
207. International role
208. 118Co-operation between parties to the Data Protection Convention
209. 119Inspection of personal data in accordance with international obligations
210. 119AStandard clauses for transfers to third countries etc
211. 120Further international role
212. Duties in carrying out functions
213. 120APrincipal objective
214. 120BDuties in relation to functions under the data protection legislation
215. 120CStrategy
216. 120DDuty to consult other regulators
217. Codes of practice
218. 121Data-sharing code
219. 122Direct marketing code
220. 123Age-appropriate design code
221. 124Data protection and journalism code
222. 124AOther codes of practice
223. 124BPanels to consider codes of practice
224. 124CImpact assessments for codes of practice
225. 125Approval of codes prepared under sections 121 to 124A
226. 126Publication and review of codes issued under section 125(4)
227. 127Effect of codes issued under section 125(4)
228. 128Other codes of practice Repealed
229. Consensual audits
230. 129Consensual audits
231. Records of national security certificates
232. 130Records of national security certificates
233. Information provided to the Commission
234. 131Disclosure of information to the Commission
235. 132Confidentiality of information
236. 133Guidance about privileged communications
237. Fees
238. 134Fees for services
239. 135Manifestly unfounded or excessive requests by data subjects etc
240. 136Guidance about fees
241. Charges
242. 137Charges payable to the Commission by controllers
243. 138Regulations under section 137: supplementary
244. Reports etc
245. 139Reporting to Parliament
246. 139AAnalysis of performance
247. Documents and notices
248. 140Publication by the Commission
249. 141Notices from the Commissioner Repealed
250. 141ANotices from the Commission
251. Part 6: Enforcement
252. Information notices
253. 142Information notices
254. 143Information notices: restrictions
255. 144False statements made in response to information notices
256. 145Information orders
257. Assessment notices
258. 146Assessment notices
259. 146AAssessment notices: approval of person to prepare report etc
260. 147Assessment notices: restrictions
261. Information notices and assessment notices: destruction of documents etc
262. 148Destroying or falsifying information and documents etc
263. Interview notices
264. 148AInterview notices
265. 148BInterview notices: restrictions
266. 148CFalse statements made in response to interview notices
267. Enforcement notices
268. 149Enforcement notices
269. 150Enforcement notices: supplementary
270. 151Enforcement notices: rectification and erasure of personal data etc
271. 152Enforcement notices: restrictions
272. 153Enforcement notices: cancellation and variation
273. Powers of entry and inspection
274. 154Powers of entry and inspection
275. Penalties
276. 155Penalty notices
277. 156Penalty notices: restrictions
278. 157Maximum amount of penalty
279. 158Fixed penalties for non-compliance with charges regulations
280. 159Amount of penalties: supplementary
281. Guidance and report
282. 160Guidance about regulatory action
283. 161Approval of first guidance about regulatory action
284. 161AAnnual report on regulatory action
285. Appeals etc
286. 162Rights of appeal
287. 163Determination of appeals
288. 164Applications in respect of urgent notices
289. Complaints
290. 164AComplaints by data subjects to controllers
291. 164BControllers to notify the Commission of the number of complaints
292. 165Complaints by data subjects to the Commission
293. 166Orders to progress complaints to the Commission
294. Remedies in the court
295. 167Compliance orders
296. 168Compensation for contravention of the UK GDPR
297. 169Compensation for contravention of other data protection legislation
298. Offences relating to personal data
299. 170Unlawful obtaining etc of personal data
300. 171Re-identification of de-identified personal data
301. 172Re-identification: effectiveness testing conditions
302. 173Alteration etc of personal data to prevent disclosure to data subject
303. The special purposes
304. 174The special purposes
305. 175Provision of assistance in special purposes proceedings
306. 176Staying special purposes proceedings
307. 177Guidance about how to seek redress against media organisations
308. 178Review of processing of personal data for the purposes of journalism
309. 179Effectiveness of the media's dispute resolution procedures
310. Jurisdiction and court procedure
311. 180Jurisdiction
312. 180AProcedure in connection with subject access requests
313. Definitions
314. 181Interpretation of Part 6
315. Part 7: Supplementary and final provision
316. Regulations under this Act
317. 182Regulations and consultation
318. Changes to the Data Protection Convention
319. 183Power to reflect changes to the Data Protection Convention
320. Prohibitions and restrictions etc on processing
321. 183AProtection of prohibitions and restrictions etc on processing: relevant enactments
322. 183BProtection of prohibitions and restrictions etc on processing: other enactments
323. Rights of the data subject
324. 184Prohibition of requirement to produce relevant records
325. 185Avoidance of certain contractual terms relating to health records
326. 186Protection of data subject’s rights
327. 186AProtection of data subject’s rights: further provision
328. Representation of data subjects
329. 187Representation of data subjects with their authority
330. Framework for Data Processing by Government
331. 191Framework for Data Processing by Government
332. 192Approval of the Framework
333. 193Publication and review of the Framework
334. 194Effect of the Framework
335. Data-sharing: HMRC and reserve forces
336. 195Reserve forces: data-sharing by HMRC
337. Offences
338. 196Penalties for offences
339. 197Prosecution
340. 198Liability of directors etc
341. 200Guidance about PACE codes of practice
342. The Tribunal
343. 201Disclosure of information to the Tribunal
344. 202Proceedings in the First-tier Tribunal: contempt
345. 203Tribunal Procedure Rules
346. Interpretation
347. 204Meaning of “health professional” and “social work professional”
348. 205General interpretation
349. 206Index of defined expressions
350. Territorial application
351. 207Territorial application of this Act
352. General
353. 208Children in Scotland
354. 209Application to the Crown
355. 210Application to Parliament
356. 211Minor and consequential provision
357. Final
358. 212Commencement
359. 213Transitional provision
360. 214Extent
361. 215Short title
362. Schedule A1Processing in reliance on relevant international law
363. Schedule 1: Special categories of personal data and criminal convictions etc data
364. Part 1: Conditions relating to employment, health and research etc
365. Employment, social security and social protection
366. 1Paragraph 1
367. Health or social care purposes
368. 2Paragraph 2
369. Public health
370. 3Paragraph 3
371. Research etc
372. 4Paragraph 4
373. Part 2: Substantial public interest conditions
374. Requirement for an appropriate policy document when relying on conditions in this Part
375. 5Paragraph 5
376. Statutory etc and government purposes
377. 6Paragraph 6
378. Administration of justice and parliamentary purposes
379. 7Paragraph 7
380. Equality of opportunity or treatment
381. 8Paragraph 8
382. Racial and ethnic diversity at senior levels of organisations
383. 9Paragraph 9
384. Preventing etc unlawful acts
385. 10Paragraph 10
386. Protecting the public against dishonesty etc
387. 11Paragraph 11
388. Regulatory requirements relating to unlawful acts and dishonesty etc
389. 12Paragraph 12
390. Journalism etc in connection with unlawful acts and dishonesty etc
391. 13Paragraph 13
392. Preventing fraud
393. 14Paragraph 14
394. Suspicion of terrorist financing or money laundering
395. 15Paragraph 15
396. Support for individuals with a particular disability or medical condition
397. 16Paragraph 16
398. Counselling etc
399. 17Paragraph 17
400. Safeguarding of children and of individuals at risk
401. 18Paragraph 18
402. Safeguarding of economic well-being of certain individuals
403. 19Paragraph 19
404. Insurance
405. 20Paragraph 20
406. Occupational pensions
407. 21Paragraph 21
408. Political parties
409. 22Paragraph 22
410. Elected representatives responding to requests
411. 23Paragraph 23
412. Disclosure to elected representatives
413. 24Paragraph 24
414. Informing elected representatives about prisoners
415. 25Paragraph 25
416. Publication of legal judgments
417. 26Paragraph 26
418. Anti-doping in sport
419. 27Paragraph 27
420. Standards of behaviour in sport
421. 28Paragraph 28
422. Part 3: Additional conditions relating to criminal convictions etc
423. Consent
424. 29Paragraph 29
425. Protecting individual's vital interests
426. 30Paragraph 30
427. Processing by not-for-profit bodies
428. 31Paragraph 31
429. Personal data in the public domain
430. 32Paragraph 32
431. Legal claims
432. 33Paragraph 33
433. Judicial acts
434. 34Paragraph 34
435. Administration of accounts used in commission of indecency offences involving children
436. 35Paragraph 35
437. Extension of conditions in Part 2 of this Schedule referring to substantial public interest
438. 36Paragraph 36
439. Extension of insurance conditions
440. 37Paragraph 37
441. Part 4: Appropriate policy document and additional safeguards
442. Application of this Part of this Schedule
443. 38Paragraph 38
444. Requirement to have an appropriate policy document in place
445. 39Paragraph 39
446. Additional safeguard: retention of appropriate policy document
447. 40Paragraph 40
448. Additional safeguard: record of processing
449. 41Paragraph 41
450. Schedule 2: Exemptions etc from the UK GDPR
451. Part 1: Adaptations and restrictions as described in Articles 6(3) and 23(1)
452. UK GDPR provisions to be adapted or restricted: “the listed GDPR provisions”
453. 1Paragraph 1
454. Crime and taxation: general
455. 2Paragraph 2
456. Crime and taxation: risk assessment systems
457. 3Paragraph 3
458. Immigration
459. 4Paragraph 4
460. Immigration: safeguards: immigration exemption decisions
461. 4AParagraph 4A
462. Immigration: safeguard: record of decision that exemption applies
463. 4BParagraph 4B
464. Information required to be disclosed by law etc or in connection with legal proceedings
465. 5Paragraph 5
466. Part 2: Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34
467. UK GDPR provisions to be restricted: “the listed GDPR provisions”
468. 6Paragraph 6
469. Functions designed to protect the public etc
470. 7Paragraph 7
471. Audit functions
472. 8Paragraph 8
473. Functions of the Bank of England
474. 9Paragraph 9
475. Regulatory functions relating to legal services, the health service and children's services
476. 10Paragraph 10
477. Regulatory functions of certain other persons
478. 11Paragraph 11
479. 12Paragraph 12
480. Parliamentary privilege
481. 13Paragraph 13
482. Judicial appointments, judicial independence and judicial proceedings
483. 14Paragraph 14
484. Crown honours, dignities and appointments
485. 15Paragraph 15
486. Part 3: Restriction for the protection of rights of others
487. Protection of the rights of others: general
488. 16Paragraph 16
489. Assumption of reasonableness for health workers, social workers and education workers
490. 17Paragraph 17
491. Part 4: Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15
492. UK GDPR provisions to be restricted: “the listed GDPR provisions”
493. 18Paragraph 18
494. Legal professional privilege
495. 19Paragraph 19
496. Self incrimination
497. 20Paragraph 20
498. Corporate finance
499. 21Paragraph 21
500. Management forecasts
501. 22Paragraph 22
502. Negotiations
503. 23Paragraph 23
504. Confidential references
505. 24Paragraph 24
506. Exam scripts and exam marks
507. 25Paragraph 25
508. Part 5: Exemptions etc ... for reasons of freedom of expression and information
509. Journalistic, academic, artistic and literary purposes
510. 26Paragraph 26
511. Part 6: Derogations etc ... for research, statistics and archiving
512. Research and statistics
513. 27Paragraph 27
514. Archiving in the public interest
515. 28Paragraph 28
516. Schedule 3: Exemptions etc from the UK GDPR: health, social work, education and child abuse data
517. Part 1: UK GDPR provisions to be restricted
518. 1Paragraph 1
519. Part 2: Health data
520. Definitions
521. 2Paragraph 2
522. Exemption from the listed GDPR provisions: data processed by a court
523. 3Paragraph 3
524. Exemption from the listed GDPR provisions: data subject's expectations and wishes
525. 4Paragraph 4
526. Exemption from Article 15 of the UK GDPR: serious harm
527. 5Paragraph 5
528. Restriction of Article 15 of the UK GDPR: prior opinion of appropriate health professional
529. 6Paragraph 6
530. Part 3: Social work data
531. Definitions
532. 7Paragraph 7
533. 8Paragraph 8
534. Exemption from the listed GDPR provisions: data processed by a court
535. 9Paragraph 9
536. Exemption from the listed GDPR provisions: data subject's expectations and wishes
537. 10Paragraph 10
538. Exemption from Article 15 of the UK GDPR: serious harm
539. 11Paragraph 11
540. Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
541. 12Paragraph 12
542. Part 4: Education data
543. Educational records
544. 13Paragraph 13
545. 14Paragraph 14
546. 15Paragraph 15
547. 16Paragraph 16
548. Other definitions
549. 17Paragraph 17
550. Exemption from the listed GDPR provisions: data processed by a court
551. 18Paragraph 18
552. Exemption from Article 15 of the UK GDPR: serious harm
553. 19Paragraph 19
554. Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
555. 20Paragraph 20
556. Part 5: Child abuse data
557. Exemption from Article 15 of the UK GDPR: child abuse data
558. 21Paragraph 21
559. Schedule 4: Exemptions etc from the UK GDPR: disclosure prohibited or restricted by an enactment
560. UK GDPR provisions to be restricted: “the listed GDPR provisions”
561. 1Paragraph 1
562. Human fertilisation and embryology information
563. 2Paragraph 2
564. Adoption records and reports
565. 3Paragraph 3
566. Statements of special educational needs
567. 4Paragraph 4
568. Parental order records and reports
569. 5Paragraph 5
570. Information provided by Principal Reporter for children's hearing
571. 6Paragraph 6
572. Schedule 5: Accreditation of certification providers: reviews and appeals
573. Introduction
574. 1Paragraph 1
575. Review
576. 2Paragraph 2
577. Right to appeal
578. 3Paragraph 3
579. Appeal panel
580. 4Paragraph 4
581. Hearing
582. 5Paragraph 5
583. Decision following referral to appeal panel
584. 6Paragraph 6
585. Meaning of “working day”
586. 7Paragraph 7
587. Schedule 6: The applied GDPR and the applied Chapter 2 Repealed
588. Part 1: Modifications to the GDPR Repealed
589. Introductory Repealed
590. 1Paragraph 1 Repealed
591. References to the GDPR and its provisions Repealed
592. 2Paragraph 2 Repealed
593. References to Union law and Member State law Repealed
594. 3Paragraph 3 Repealed
595. References to the Union and to Member States Repealed
596. 4Paragraph 4 Repealed
597. References to supervisory authorities Repealed
598. 5Paragraph 5 Repealed
599. References to the national parliament Repealed
600. 6Paragraph 6 Repealed
601. Chapter I of the GDPR (general provisions) Repealed
602. 7Paragraph 7 Repealed
603. 8Paragraph 8 Repealed
604. 9Paragraph 9 Repealed
605. Chapter II of the GDPR (principles) Repealed
606. 10Paragraph 10 Repealed
607. 11Paragraph 11 Repealed
608. 12Paragraph 12 Repealed
609. 13Paragraph 13 Repealed
610. Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities) Repealed
611. 14Paragraph 14 Repealed
612. Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data) Repealed
613. 15Paragraph 15 Repealed
614. 16Paragraph 16 Repealed
615. Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure) Repealed
616. 17Paragraph 17 Repealed
617. 18Paragraph 18 Repealed
618. Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making) Repealed
619. 19Paragraph 19 Repealed
620. 20Paragraph 20 Repealed
621. Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions) Repealed
622. 21Paragraph 21 Repealed
623. Section 1 of Chapter IV of the GDPR (controller and processor: general obligations) Repealed
624. 22Paragraph 22 Repealed
625. 23Paragraph 23 Repealed
626. 24Paragraph 24 Repealed
627. 25Paragraph 25 Repealed
628. 26Paragraph 26 Repealed
629. Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation) Repealed
630. 27Paragraph 27 Repealed
631. 28Paragraph 28 Repealed
632. Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer) Repealed
633. 29Paragraph 29 Repealed
634. 30Paragraph 30 Repealed
635. Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification) Repealed
636. 31Paragraph 31 Repealed
637. 32Paragraph 32 Repealed
638. 33Paragraph 33 Repealed
639. 34Paragraph 34 Repealed
640. Chapter V of the GDPR (transfers of data to third countries or international organisations) Repealed
641. 35Paragraph 35 Repealed
642. 36Paragraph 36 Repealed
643. 37Paragraph 37 Repealed
644. 38Paragraph 38 Repealed
645. 39Paragraph 39 Repealed
646. Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status) Repealed
647. 40Paragraph 40 Repealed
648. 41Paragraph 41 Repealed
649. 42Paragraph 42 Repealed
650. 43Paragraph 43 Repealed
651. Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers) Repealed
652. 44Paragraph 44 Repealed
653. 45Paragraph 45 Repealed
654. 46Paragraph 46 Repealed
655. 47Paragraph 47 Repealed
656. 48Paragraph 48 Repealed
657. Chapter VII of the GDPR (co-operation and consistency) Repealed
658. 49Paragraph 49 Repealed
659. Chapter VIII of the GDPR (remedies, liability and penalties) Repealed
660. 50Paragraph 50 Repealed
661. 51Paragraph 51 Repealed
662. 52Paragraph 52 Repealed
663. 53Paragraph 53 Repealed
664. 54Paragraph 54 Repealed
665. 55Paragraph 55 Repealed
666. 56Paragraph 56 Repealed
667. 57Paragraph 57 Repealed
668. Chapter IX of the GDPR (provisions relating to specific processing situations) Repealed
669. 58Paragraph 58 Repealed
670. 59Paragraph 59 Repealed
671. 60Paragraph 60 Repealed
672. 61Paragraph 61 Repealed
673. 62Paragraph 62 Not yet in force
674. 63Paragraph 63 Repealed
675. 64Paragraph 64 Repealed
676. Chapter X of the GDPR (delegated acts and implementing acts) Repealed
677. 65Paragraph 65 Repealed
678. 66Paragraph 66 Repealed
679. Chapter XI of the GDPR (final provisions) Repealed
680. 67Paragraph 67 Repealed
681. 68Paragraph 68 Repealed
682. 69Paragraph 69 Repealed
683. 70Paragraph 70 Repealed
684. 71Paragraph 71 Repealed
685. 72Paragraph 72 Repealed
686. Part 2: Modifications to Chapter 2 of Part 2 Repealed
687. Introductory Repealed
688. 73Paragraph 73 Repealed
689. General modifications Repealed
690. 74Paragraph 74 Repealed
691. Exemptions Repealed
692. 75Paragraph 75 Repealed
693. Schedule 7: Competent authorities
694. 1Paragraph 1
695. 2Paragraph 2
696. 3Paragraph 3
697. 4Paragraph 4
698. Chief officers of police and other policing bodies
699. 5Paragraph 5
700. 6Paragraph 6
701. 7Paragraph 7
702. 8Paragraph 8
703. 9Paragraph 9
704. 10Paragraph 10
705. 11Paragraph 11
706. 12Paragraph 12
707. 13Paragraph 13
708. 14Paragraph 14
709. 15Paragraph 15
710. 15AParagraph 15A
711. 16Paragraph 16
712. 17Paragraph 17
713. 18Paragraph 18
714. 18AParagraph 18A
715. 19Paragraph 19
716. 20Paragraph 20
717. Other authorities with investigatory functions
718. 21Paragraph 21
719. 22Paragraph 22
720. 23Paragraph 23
721. 24Paragraph 24
722. 25Paragraph 25
723. 26Paragraph 26
724. 27Paragraph 27
725. 28Paragraph 28
726. 29Paragraph 29
727. 30Paragraph 30
728. 31Paragraph 31
729. 32Paragraph 32
730. 33Paragraph 33
731. 34Paragraph 34
732. 35Paragraph 35
733. Authorities with functions relating to offender management
734. 36Paragraph 36
735. 37Paragraph 37
736. 38Paragraph 38
737. 39Paragraph 39
738. 40Paragraph 40
739. 41Paragraph 41
740. 42Paragraph 42
741. 43Paragraph 43
742. 44Paragraph 44
743. 45Paragraph 45
744. 46Paragraph 46
745. Other authorities
746. 47Paragraph 47
747. 48Paragraph 48
748. 49Paragraph 49
749. 50Paragraph 50
750. 51Paragraph 51
751. 51AParagraph 51A
752. 52Paragraph 52 Repealed
753. 53Paragraph 53
754. 54Paragraph 54
755. 55Paragraph 55
756. 56Paragraph 56
757. 57Paragraph 57
758. Schedule 8: Conditions for sensitive processing under Part 3
759. Statutory etc purposes
760. 1Paragraph 1
761. Administration of justice
762. 2Paragraph 2
763. Protecting individual's vital interests
764. 3Paragraph 3
765. Safeguarding of children and of individuals at risk
766. 4Paragraph 4
767. Personal data already in the public domain
768. 5Paragraph 5
769. Legal claims
770. 6Paragraph 6
771. Judicial acts
772. 7Paragraph 7
773. Preventing fraud
774. 8Paragraph 8
775. Archiving etc
776. 9Paragraph 9
777. Schedule 9: Conditions for processing under Part 4
778. 1Paragraph 1
779. 2Paragraph 2
780. 3Paragraph 3
781. 4Paragraph 4
782. 5Paragraph 5
783. 6Paragraph 6
784. Schedule 10: Conditions for sensitive processing under Part 4
785. Consent to particular processing
786. 1Paragraph 1
787. Right or obligation relating to employment
788. 2Paragraph 2
789. Vital interests of a person
790. 3Paragraph 3
791. Safeguarding of children and of individuals at risk
792. 4Paragraph 4
793. Data already published by data subject
794. 5Paragraph 5
795. Legal proceedings etc
796. 6Paragraph 6
797. Administration of justice, parliamentary, statutory etc and government purposes
798. 7Paragraph 7
799. Medical purposes
800. 8Paragraph 8
801. Equality
802. 9Paragraph 9
803. Schedule 11: Other exemptions under Part 4
804. Preliminary
805. 1Paragraph 1
806. Crime
807. 2Paragraph 2
808. Information required to be disclosed by law etc or in connection with legal proceedings
809. 3Paragraph 3
810. Parliamentary privilege
811. 4Paragraph 4
812. Judicial proceedings
813. 5Paragraph 5
814. Crown honours and dignities
815. 6Paragraph 6
816. Armed forces
817. 7Paragraph 7
818. Economic well-being
819. 8Paragraph 8
820. Legal professional privilege
821. 9Paragraph 9
822. Negotiations
823. 10Paragraph 10
824. Confidential references given by the controller
825. 11Paragraph 11
826. Exam scripts and marks
827. 12Paragraph 12
828. Research and statistics
829. 13Paragraph 13
830. Archiving in the public interest
831. 14Paragraph 14
832. Schedule 12: The Information Commissioner Repealed
833. Status and capacity Repealed
834. 1Paragraph 1 Repealed
835. Appointment Repealed
836. 2Paragraph 2 Repealed
837. Resignation and removal Repealed
838. 3Paragraph 3 Repealed
839. Salary etc Repealed
840. 4Paragraph 4 Repealed
841. Officers and staff Repealed
842. 5Paragraph 5 Repealed
843. Carrying out of the Commissioner's functions by officers and staff Repealed
844. 6Paragraph 6 Repealed
845. 7Paragraph 7 Repealed
846. 8Paragraph 8 Repealed
847. Money Repealed
848. 9Paragraph 9 Repealed
849. Fees etc and other sums Repealed
850. 10Paragraph 10 Repealed
851. Accounts Repealed
852. 11Paragraph 11 Repealed
853. Scotland Repealed
854. 12Paragraph 12 Repealed
855. Schedule 12A: The Information Commission
856. 1Status
857. 2Number of members
858. 3Membership: general
859. 4Membership: non-executive members to outnumber executive members
860. 5Membership: selection on merit etc
861. 6Membership: conflicts of interests
862. 7Tenure of the chair
863. 8Tenure of deputy chair
864. 9Tenure of the other non-executive members
865. 10Remuneration and pensions of non-executive members
866. 11Executive members: terms and conditions
867. 12Other staff: appointment, terms and conditions
868. 13Committees
869. 14Delegation of functions
870. 15Advice from committees
871. 16Proceedings
872. 17Records of proceedings
873. 18Disqualification for acting in relation to certain matters
874. 19Validity of proceedings
875. 20Money
876. 21Fees etc and other sums
877. 22Accounts
878. 24Supplementary powers
879. 25Transitional provision: interim chief executive
880. 26Interpretation
881. Schedule 13: Other general functions of the Commission
882. General tasks
883. 1Paragraph 1
884. General powers
885. 2Paragraph 2
886. Definitions
887. 3Paragraph 3
888. Schedule 14: Co-operation and mutual assistance
889. Part 1: Law Enforcement Directive Repealed
890. Co-operation Repealed
891. 1Paragraph 1 Repealed
892. Requests for information and assistance from LED supervisory authorities Repealed
893. 2Paragraph 2 Repealed
894. Fees Repealed
895. 3Paragraph 3 Repealed
896. Restrictions on use of information Repealed
897. 4Paragraph 4 Repealed
898. LED supervisory authority Repealed
899. 5Paragraph 5 Repealed
900. Part 2: Data Protection Convention
901. Co-operation between the Commission and foreign designated authorities
902. 6Paragraph 6
903. Assisting persons resident outside the UK with requests under Article 14 of the Convention
904. 7Paragraph 7
905. Assisting UK residents with requests under Article 8 of the Convention
906. 8Paragraph 8
907. Restrictions on use of information
908. 9Paragraph 9
909. Foreign designated authority
910. 10Paragraph 10
911. Schedule 15: Powers of entry and inspection
912. Issue of warrants in connection with non-compliance and offences
913. 1Paragraph 1
914. Issue of warrants in connection with assessment notices
915. 2Paragraph 2
916. Restrictions on issuing warrants: processing for the special purposes
917. 3Paragraph 3
918. Restrictions on issuing warrants: procedural requirements
919. 4Paragraph 4
920. Content of warrants
921. 5Paragraph 5
922. Copies of warrants
923. 6Paragraph 6
924. Execution of warrants: reasonable force
925. 7Paragraph 7
926. Execution of warrants: time when executed
927. 8Paragraph 8
928. Execution of warrants: occupier of premises
929. 9Paragraph 9
930. Execution of warrants: seizure of documents etc
931. 10Paragraph 10
932. Matters exempt from inspection and seizure: privileged communications
933. 11Paragraph 11
934. Matters exempt from inspection and seizure: Parliamentary privilege
935. 12Paragraph 12
936. Partially exempt material
937. 13Paragraph 13
938. Return of warrants
939. 14Paragraph 14
940. Offences
941. 15Paragraph 15
942. Self-incrimination
943. 16Paragraph 16
944. Vessels, vehicles etc
945. 17Paragraph 17
946. Scotland
947. 18Paragraph 18
948. Northern Ireland
949. 19Paragraph 19
950. Schedule 16: Penalties
951. Meaning of “penalty”
952. 1Paragraph 1
953. Notice of intent to impose penalty
954. 2Paragraph 2
955. Contents of notice of intent
956. 3Paragraph 3
957. Giving a penalty notice
958. 4Paragraph 4
959. Contents of penalty notice
960. 5Paragraph 5
961. Period for payment of penalty
962. 6Paragraph 6
963. Variation of penalty
964. 7Paragraph 7
965. Cancellation of penalty
966. 8Paragraph 8
967. Enforcement of payment
968. 9Paragraph 9
969. Schedule 17: Review of processing of personal data for the purposes of journalism
970. Interpretation
971. 1Paragraph 1
972. Information notices
973. 2Paragraph 2
974. Assessment notices
975. 3Paragraph 3
976. Interview notices
977. 3AParagraph 3A
978. Applications in respect of urgent notices
979. 4Paragraph 4
980. Schedule 18: Relevant records
981. Relevant records
982. 1Paragraph 1
983. Relevant health records
984. 2Paragraph 2
985. Relevant records relating to a conviction or caution
986. 3Paragraph 3
987. Relevant records relating to statutory functions
988. 4Paragraph 4
989. Data subject access right
990. 5Paragraph 5
991. Records stating that personal data is not processed
992. 6Paragraph 6
993. Power to amend
994. 7Paragraph 7
995. Schedule 19: Minor and consequential amendments
996. Part 1: Amendments of primary legislation
997. Registration Service Act 1953 (c. 37)
998. 1Paragraph 1
999. Veterinary Surgeons Act 1966 (c. 36)
1000. 2Paragraph 2
1001. Parliamentary Commissioner Act 1967 (c. 13)
1002. 3Paragraph 3
1003. Local Government Act 1974 (c. 7)
1004. 4Paragraph 4
1005. 5Paragraph 5
1006. 6Paragraph 6
1007. Consumer Credit Act 1974 (c. 39)
1008. 7Paragraph 7
1009. 8Paragraph 8
1010. 9Paragraph 9
1011. 10Paragraph 10
1012. Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))
1013. 11Paragraph 11
1014. 12Paragraph 12
1015. 13Paragraph 13
1016. 14Paragraph 14
1017. 15Paragraph 15
1018. 16Paragraph 16
1019. 17Paragraph 17
1020. Representation of the People Act 1983 (c. 2)
1021. 18Paragraph 18
1022. Medical Act 1983 (c. 54)
1023. 19Paragraph 19
1024. 20Paragraph 20
1025. 21Paragraph 21
1026. 22Paragraph 22
1027. 23Paragraph 23
1028. 24Paragraph 24
1029. 25Paragraph 25
1030. 26Paragraph 26
1031. Dentists Act 1984 (c. 24)
1032. 27Paragraph 27
1033. 28Paragraph 28
1034. 29Paragraph 29
1035. 30Paragraph 30
1036. 31Paragraph 31
1037. 32Paragraph 32
1038. Companies Act 1985 (c. 6)
1039. 33Paragraph 33
1040. Access to Medical Reports Act 1988 (c. 28)
1041. 34Paragraph 34
1042. Opticians Act 1989 (c. 44)
1043. 35Paragraph 35
1044. Access to Health Records Act 1990 (c. 23)
1045. 36Paragraph 36
1046. 37Paragraph 37
1047. 38Paragraph 38
1048. Human Fertilisation and Embryology Act 1990 (c. 37)
1049. 39Paragraph 39
1050. Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)
1051. 40Paragraph 40
1052. Tribunals and Inquiries Act 1992 (c. 53)
1053. 41Paragraph 41
1054. Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))
1055. 42Paragraph 42
1056. Health Service Commissioners Act 1993 (c. 46)
1057. 43Paragraph 43
1058. Data Protection Act 1998 (c. 29)
1059. 44Paragraph 44
1060. Crime and Disorder Act 1998 (c. 37)
1061. 45Paragraph 45
1062. Food Standards Act 1999 (c. 28)
1063. 46Paragraph 46
1064. Immigration and Asylum Act 1999 (c. 33)
1065. 47Paragraph 47
1066. Financial Services and Markets Act 2000 (c. 8)
1067. 48Paragraph 48
1068. 49Paragraph 49 Repealed
1069. 50Paragraph 50
1070. 51Paragraph 51
1071. 52Paragraph 52
1072. 53Paragraph 53
1073. Terrorism Act 2000 (c. 11)
1074. 54Paragraph 54
1075. Freedom of Information Act 2000 (c. 36)
1076. 55Paragraph 55
1077. 56Paragraph 56
1078. 57Paragraph 57
1079. 58Paragraph 58
1080. 59Paragraph 59
1081. 60Paragraph 60
1082. 61Paragraph 61
1083. 62Paragraph 62
1084. 63Paragraph 63
1085. 64Paragraph 64
1086. Political Parties, Elections and Referendums Act 2000 (c. 41)
1087. 65Paragraph 65
1088. Public Finance and Accountability (Scotland) Act 2000 (asp 1)
1089. 66Paragraph 66
1090. 67Paragraph 67
1091. 68Paragraph 68
1092. 69Paragraph 69
1093. Criminal Justice and Police Act 2001 (c. 16)
1094. 70Paragraph 70
1095. 71Paragraph 71
1096. 72Paragraph 72
1097. 73Paragraph 73
1098. Anti-terrorism, Crime and Security Act 2001 (c.24)
1099. 74Paragraph 74
1100. 75Paragraph 75
1101. 76Paragraph 76 Not yet in force
1102. Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))
1103. 77Paragraph 77
1104. Justice (Northern Ireland) Act 2002 (c. 26)
1105. 78Paragraph 78
1106. Proceeds of Crime Act 2002 (c. 29)
1107. 79Paragraph 79
1108. 80Paragraph 80
1109. 81Paragraph 81
1110. 82Paragraph 82
1111. 83Paragraph 83
1112. 84Paragraph 84
1113. 85Paragraph 85
1114. Enterprise Act 2002 (c. 40)
1115. 86Paragraph 86
1116. Scottish Public Services Ombudsman Act 2002 (asp 11)
1117. 87Paragraph 87
1118. Freedom of Information (Scotland) Act 2002 (asp 13)
1119. 88Paragraph 88
1120. 89Paragraph 89
1121. 90Paragraph 90
1122. Courts Act 2003 (c. 39)
1123. 91Paragraph 91
1124. 92Paragraph 92
1125. 93Paragraph 93
1126. Sexual Offences Act 2003 (c. 42)
1127. 94Paragraph 94
1128. Criminal Justice Act 2003 (c. 44)
1129. 95Paragraph 95
1130. 96Paragraph 96
1131. 97Paragraph 97
1132. Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)
1133. 98Paragraph 98
1134. Public Audit (Wales) Act 2004 (c. 23)
1135. 99Paragraph 99
1136. Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)
1137. 100Paragraph 100
1138. 101Paragraph 101
1139. 102Paragraph 102
1140. Domestic Violence, Crime and Victims Act 2004 (c. 28)
1141. 103Paragraph 103
1142. Children Act 2004 (c. 31)
1143. 104Paragraph 104
1144. 105Paragraph 105
1145. 106Paragraph 106
1146. Constitutional Reform Act 2005 (c. 4)
1147. 107Paragraph 107
1148. Mental Capacity Act 2005 (c. 9)
1149. 108Paragraph 108
1150. Public Services Ombudsman (Wales) Act 2005 (c. 10)
1151. 109Paragraph 109
1152. Commissioners for Revenue and Customs Act 2005 (c. 11)
1153. 110Paragraph 110
1154. Gambling Act 2005 (c. 19)
1155. 111Paragraph 111
1156. Commissioner for Older People (Wales) Act 2006 (c. 30)
1157. 112Paragraph 112
1158. National Health Service Act 2006 (c. 41)
1159. 113Paragraph 113
1160. 114Paragraph 114
1161. 115Paragraph 115
1162. 116Paragraph 116
1163. National Health Service (Wales) Act 2006 (c. 42)
1164. 117Paragraph 117
1165. 118Paragraph 118
1166. 119Paragraph 119
1167. Companies Act 2006 (c. 46)
1168. 120Paragraph 120
1169. 121Paragraph 121
1170. 122Paragraph 122
1171. 123Paragraph 123
1172. 124Paragraph 124
1173. 125Paragraph 125
1174. 126Paragraph 126
1175. 127Paragraph 127
1176. 128Paragraph 128
1177. 129Paragraph 129
1178. Tribunals, Courts and Enforcement Act 2007 (c. 15)
1179. 130Paragraph 130
1180. 131Paragraph 131
1181. 132Paragraph 132
1182. Statistics and Registration Service Act 2007 (c. 18)
1183. 133Paragraph 133
1184. 134Paragraph 134
1185. 135Paragraph 135
1186. 136Paragraph 136
1187. 137Paragraph 137
1188. 138Paragraph 138
1189. 139Paragraph 139
1190. 140Paragraph 140
1191. 141Paragraph 141
1192. 142Paragraph 142
1193. Serious Crime Act 2007 (c. 27)
1194. 143Paragraph 143
1195. 144Paragraph 144
1196. 145Paragraph 145
1197. 146Paragraph 146
1198. Legal Services Act 2007 (c. 29)
1199. 147Paragraph 147
1200. Adoption and Children (Scotland) Act 2007 (asp 4)
1201. 148Paragraph 148
1202. Criminal Justice and Immigration Act 2008 (c. 4)
1203. 149Paragraph 149
1204. 150Paragraph 150
1205. 151Paragraph 151
1206. Regulatory Enforcement and Sanctions Act 2008 (c. 13)
1207. 152Paragraph 152
1208. Health and Social Care Act 2008 (c. 14)
1209. 153Paragraph 153
1210. Counter-Terrorism Act 2008 (c. 28)
1211. 154Paragraph 154
1212. Public Health etc. (Scotland) Act 2008 (asp 5)
1213. 155Paragraph 155
1214. Banking Act 2009 (c. 1)
1215. 156Paragraph 156
1216. Borders, Citizenship and Immigration Act 2009 (c. 11)
1217. 157Paragraph 157
1218. Marine and Coastal Access Act 2009 (c. 23)
1219. 158Paragraph 158
1220. 159Paragraph 159
1221. 160Paragraph 160
1222. Coroners and Justice Act 2009 (c. 25)
1223. 161Paragraph 161
1224. Broads Authority Act 2009 (c. i)
1225. 162Paragraph 162
1226. Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))
1227. 163Paragraph 163
1228. Terrorist Asset-Freezing etc. Act 2010 (c. 38)
1229. 164Paragraph 164
1230. Marine (Scotland) Act 2010 (asp 5)
1231. 165Paragraph 165
1232. Charities Act 2011 (c. 25)
1233. 166Paragraph 166
1234. Welsh Language (Wales) Measure 2011 (nawm 1)
1235. 167Paragraph 167
1236. 168Paragraph 168
1237. 169Paragraph 169
1238. Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))
1239. 170Paragraph 170
1240. Health and Social Care Act 2012 (c. 7)
1241. 171Paragraph 171
1242. 172Paragraph 172
1243. 173Paragraph 173
1244. 174Paragraph 174
1245. Protection of Freedoms Act 2012 (c. 9)
1246. 175Paragraph 175
1247. 176Paragraph 176
1248. 177Paragraph 177
1249. 178Paragraph 178
1250. HGV Road User Levy Act 2013 (c. 7)
1251. 179Paragraph 179
1252. Crime and Courts Act 2013 (c. 22)
1253. 180Paragraph 180
1254. 181Paragraph 181
1255. 182Paragraph 182
1256. Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))
1257. 183Paragraph 183
1258. Local Audit and Accountability Act 2014 (c. 2)
1259. 184Paragraph 184
1260. Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)
1261. 185Paragraph 185
1262. Immigration Act 2014 (c. 22)
1263. 186Paragraph 186
1264. Care Act 2014 (c. 23)
1265. 187Paragraph 187
1266. Social Services and Well-being (Wales) Act 2014 (anaw 4)
1267. 188Paragraph 188
1268. Counter-Terrorism and Security Act 2015 (c. 6)
1269. 189Paragraph 189
1270. Small Business, Enterprise and Employment Act 2015 (c. 26)
1271. 190Paragraph 190
1272. Modern Slavery Act 2015 (c. 30)
1273. 191Paragraph 191 Repealed
1274. Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))
1275. 192Paragraph 192
1276. 193Paragraph 193
1277. 194Paragraph 194
1278. 195Paragraph 195
1279. Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))
1280. 196Paragraph 196
1281. Immigration Act 2016 (c. 19)
1282. 197Paragraph 197 Repealed
1283. Investigatory Powers Act 2016 (c. 25)
1284. 198Paragraph 198
1285. 199Paragraph 199
1286. 200Paragraph 200
1287. 201Paragraph 201 Not yet in force
1288. 202Paragraph 202
1289. 203Paragraph 203
1290. Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))
1291. 204Paragraph 204
1292. Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))
1293. 205Paragraph 205
1294. Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))
1295. 206Paragraph 206
1296. Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))
1297. 207Paragraph 207
1298. 208Paragraph 208
1299. 209Paragraph 209
1300. Policing and Crime Act 2017 (c. 3)
1301. 210Paragraph 210
1302. Children and Social Work Act 2017 (c. 12)
1303. 211Paragraph 211
1304. Higher Education and Research Act 2017 (c. 29)
1305. 212Paragraph 212
1306. 213Paragraph 213
1307. 214Paragraph 214
1308. Digital Economy Act 2017 (c. 30)
1309. 215Paragraph 215
1310. 216Paragraph 216
1311. 217Paragraph 217
1312. 218Paragraph 218
1313. 219Paragraph 219
1314. 220Paragraph 220
1315. 221Paragraph 221
1316. 222Paragraph 222
1317. 223Paragraph 223
1318. 224Paragraph 224
1319. Landfill Disposals Tax (Wales) Act 2017 (anaw 3)
1320. 225Paragraph 225
1321. Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)
1322. 226Paragraph 226
1323. This Act
1324. 227Paragraph 227
1325. Part 2: Amendments of other legislation
1326. Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)
1327. 228Paragraph 228
1328. Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)
1329. 229Paragraph 229
1330. Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
1331. 230Paragraph 230
1332. 231Paragraph 231
1333. 232Paragraph 232
1334. Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)
1335. 233Paragraph 233
1336. European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)
1337. 234Paragraph 234
1338. 235Paragraph 235
1339. 236Paragraph 236
1340. Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)
1341. 237Paragraph 237
1342. Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)
1343. 238Paragraph 238
1344. Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)
1345. 239Paragraph 239
1346. Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)
1347. 240Paragraph 240
1348. Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)
1349. 241Paragraph 241
1350. Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)
1351. 242Paragraph 242
1352. Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)
1353. 243Paragraph 243
1354. Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)
1355. 244Paragraph 244
1356. Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)
1357. 245Paragraph 245
1358. Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)
1359. 246Paragraph 246
1360. Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)
1361. 247Paragraph 247
1362. Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)
1363. 248Paragraph 248
1364. Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)
1365. 249Paragraph 249
1366. Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)
1367. 250Paragraph 250
1368. Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)
1369. 251Paragraph 251
1370. Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)
1371. 252Paragraph 252
1372. 253Paragraph 253
1373. 254Paragraph 254
1374. 255Paragraph 255
1375. 256Paragraph 256
1376. 257Paragraph 257
1377. 258Paragraph 258
1378. 259Paragraph 259
1379. 260Paragraph 260
1380. 261Paragraph 261
1381. 262Paragraph 262
1382. 263Paragraph 263
1383. 264Paragraph 264
1384. Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)
1385. 265Paragraph 265
1386. 266Paragraph 266
1387. 267Paragraph 267
1388. 268Paragraph 268
1389. 269Paragraph 269
1390. 270Paragraph 270
1391. 271Paragraph 271
1392. 272Paragraph 272
1393. 273Paragraph 273
1394. 274Paragraph 274
1395. 275Paragraph 275
1396. 276Paragraph 276
1397. 277Paragraph 277
1398. Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)
1399. 278Paragraph 278
1400. Nursing and Midwifery Order 2001 (S.I. 2002/253)
1401. 279Paragraph 279
1402. 280Paragraph 280
1403. 281Paragraph 281
1404. 282Paragraph 282
1405. 283Paragraph 283
1406. 284Paragraph 284
1407. 285Paragraph 285
1408. 286Paragraph 286
1409. Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)
1410. 287Paragraph 287
1411. 288Paragraph 288
1412. 289Paragraph 289
1413. Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)
1414. 290Paragraph 290
1415. Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)
1416. 291Paragraph 291
1417. 292Paragraph 292
1418. 293Paragraph 293
1419. Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)
1420. 294Paragraph 294
1421. 295Paragraph 295
1422. 296Paragraph 296
1423. Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)
1424. 297Paragraph 297
1425. 298Paragraph 298
1426. 299Paragraph 299
1427. 300Paragraph 300
1428. European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)
1429. 301Paragraph 301
1430. 302Paragraph 302
1431. 303Paragraph 303
1432. Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)
1433. 304Paragraph 304
1434. Environmental Information Regulations 2004 (S.I. 2004/3391)
1435. 305Paragraph 305
1436. 306Paragraph 306
1437. 307Paragraph 307
1438. 308Paragraph 308
1439. 309Paragraph 309
1440. Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
1441. 310Paragraph 310
1442. 311Paragraph 311
1443. 312Paragraph 312
1444. Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)
1445. 313Paragraph 313
1446. Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)
1447. 314Paragraph 314
1448. 315Paragraph 315
1449. 316Paragraph 316
1450. Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)
1451. 317Paragraph 317
1452. Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)
1453. 318Paragraph 318
1454. Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)
1455. 319Paragraph 319
1456. 320Paragraph 320
1457. Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)
1458. 321Paragraph 321
1459. National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)
1460. 322Paragraph 322
1461. Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)
1462. 323Paragraph 323
1463. National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)
1464. 324Paragraph 324
1465. Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))
1466. 325Paragraph 325
1467. Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)
1468. 326Paragraph 326
1469. Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)
1470. 327Paragraph 327
1471. Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)
1472. 328Paragraph 328
1473. 329Paragraph 329
1474. 330Paragraph 330
1475. Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)
1476. 331Paragraph 331
1477. Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)
1478. 332Paragraph 332
1479. Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))
1480. 333Paragraph 333
1481. 334Paragraph 334
1482. 335Paragraph 335
1483. 336Paragraph 336
1484. 337Paragraph 337
1485. Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)
1486. 338Paragraph 338
1487. Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)
1488. 339Paragraph 339
1489. Overseas Companies Regulations 2009 (S.I. 2009/1801)
1490. 340Paragraph 340
1491. Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)
1492. 341Paragraph 341
1493. Provision of Services Regulations 2009 (S.I. 2009/2999)
1494. 342Paragraph 342
1495. INSPIRE Regulations 2009 (S.I. 2009/3157)
1496. 343Paragraph 343
1497. INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)
1498. 344Paragraph 344
1499. Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)
1500. 345Paragraph 345
1501. 346Paragraph 346
1502. 347Paragraph 347
1503. 348Paragraph 348
1504. 349Paragraph 349
1505. Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)
1506. 350Paragraph 350
1507. Pharmacy Order 2010 (S.I. 2010/231)
1508. 351Paragraph 351
1509. 352Paragraph 352
1510. 353Paragraph 353
1511. 354Paragraph 354
1512. 355Paragraph 355
1513. 356Paragraph 356
1514. 357Paragraph 357
1515. 358Paragraph 358
1516. 359Paragraph 359
1517. Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)
1518. 360Paragraph 360
1519. National Employment Savings Trust Order 2010 (S.I. 2010/917)
1520. 361Paragraph 361
1521. 362Paragraph 362
1522. 363Paragraph 363
1523. Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)
1524. 364Paragraph 364
1525. Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))
1526. 365Paragraph 365
1527. Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)
1528. 366Paragraph 366
1529. Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)
1530. 367Paragraph 367
1531. 368Paragraph 368
1532. 369Paragraph 369
1533. Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)
1534. 370Paragraph 370
1535. Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)
1536. 371Paragraph 371
1537. 372Paragraph 372
1538. 373Paragraph 373
1539. 374Paragraph 374
1540. 375Paragraph 375
1541. 376Paragraph 376
1542. 377Paragraph 377
1543. Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)
1544. 378Paragraph 378
1545. Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)
1546. 379Paragraph 379
1547. Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)
1548. 380Paragraph 380
1549. Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)
1550. 381Paragraph 381
1551. The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)
1552. 382Paragraph 382
1553. Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)
1554. 383Paragraph 383
1555. Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)
1556. 384Paragraph 384
1557. Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)
1558. 385Paragraph 385
1559. 386Paragraph 386
1560. 387Paragraph 387
1561. European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)
1562. 388Paragraph 388
1563. 389Paragraph 389
1564. 390Paragraph 390
1565. 391Paragraph 391
1566. 392Paragraph 392
1567. 393Paragraph 393
1568. 394Paragraph 394
1569. Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)
1570. 395Paragraph 395
1571. 396Paragraph 396
1572. 397Paragraph 397
1573. Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)
1574. 398Paragraph 398
1575. Register of People with Significant Control Regulations 2016 (S.I. 2016/339)
1576. 399Paragraph 399
1577. 400Paragraph 400
1578. 401Paragraph 401
1579. 402Paragraph 402
1580. Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)
1581. 403Paragraph 403
1582. 404Paragraph 404
1583. 405Paragraph 405
1584. 406Paragraph 406
1585. Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)
1586. 407Paragraph 407
1587. 408Paragraph 408
1588. 409Paragraph 409
1589. Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)
1590. 410Paragraph 410
1591. 411Paragraph 411
1592. 412Paragraph 412
1593. 413Paragraph 413
1594. 414Paragraph 414
1595. 415Paragraph 415
1596. 416Paragraph 416
1597. 417Paragraph 417
1598. 418Paragraph 418
1599. 419Paragraph 419
1600. Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)
1601. 420Paragraph 420
1602. Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)
1603. 421Paragraph 421
1604. National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)
1605. 422Paragraph 422
1606. 423Paragraph 423
1607. 424Paragraph 424
1608. 425Paragraph 425
1609. National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)
1610. 426Paragraph 426
1611. 427Paragraph 427
1612. 428Paragraph 428
1613. 429Paragraph 429
1614. Part 3: Modifications
1615. Introduction
1616. 430Paragraph 430
1617. General modifications
1618. 431Paragraph 431
1619. Specific modification of references to terms used in the Data Protection Act 1998
1620. 432Paragraph 432
1621. Part 4: Supplementary
1622. Definitions
1623. 433Paragraph 433
1624. Provision inserted in subordinate legislation by this Schedule
1625. 434Paragraph 434
1626. Schedule 20: Transitional provision etc
1627. Part 1: General
1628. Interpretation
1629. 1Paragraph 1
1630. Part 2: Rights of data subjects
1631. Right of access to personal data under the 1998 Act
1632. 2Paragraph 2
1633. Right to prevent processing likely to cause damage or distress under the 1998 Act
1634. 3Paragraph 3
1635. Right to prevent processing for purposes of direct marketing under the 1998 Act
1636. 4Paragraph 4
1637. Automated processing under the 1998 Act
1638. 5Paragraph 5
1639. Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations
1640. 6Paragraph 6
1641. Rectification, blocking, erasure and destruction under the 1998 Act
1642. 7Paragraph 7
1643. Jurisdiction and procedure under the 1998 Act
1644. 8Paragraph 8
1645. Exemptions under the 1998 Act
1646. 9Paragraph 9
1647. Prohibition by this Act of requirement to produce relevant records
1648. 10Paragraph 10
1649. Avoidance under this Act of certain contractual terms relating to health records
1650. 11Paragraph 11
1651. Part 3: The UK GDPR and Part 2 of this Act
1652. Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR
1653. 12Paragraph 12
1654. Manual unstructured data held by FOI public authorities
1655. 13Paragraph 13
1656. Part 4: Law enforcement and intelligence services processing
1657. Logging
1658. 14Paragraph 14
1659. Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)
1660. 15Paragraph 15
1661. Maximum fee for data subject access requests to intelligence services
1662. 16Paragraph 16
1663. Part 5: National security certificates
1664. National security certificates: processing of personal data under the 1998 Act
1665. 17Paragraph 17
1666. National security certificates: processing of personal data under the 2018 Act
1667. 18Paragraph 18
1668. Part 6: The Information Commissioner
1669. Appointment etc
1670. 19Paragraph 19
1671. Accounts
1672. 20Paragraph 20
1673. Annual report
1674. 21Paragraph 21
1675. Fees etc received by the Commissioner
1676. 22Paragraph 22
1677. 23Paragraph 23
1678. Functions in connection with the Data Protection Convention
1679. 24Paragraph 24
1680. Co-operation with the European Commission: transfers of personal data outside the EEA
1681. 25Paragraph 25
1682. Charges payable to the Commissioner by controllers
1683. 26Paragraph 26
1684. Requests for assessment
1685. 27Paragraph 27
1686. Codes of practice
1687. 28Paragraph 28
1688. Part 7: Enforcement etc under the 1998 Act
1689. Interpretation of this Part
1690. 29Paragraph 29
1691. Information notices
1692. 30Paragraph 30
1693. Special information notices
1694. 31Paragraph 31
1695. Assessment notices
1696. 32Paragraph 32
1697. Enforcement notices
1698. 33Paragraph 33
1699. Determination by Commissioner as to the special purposes
1700. 34Paragraph 34
1701. Restriction on enforcement in case of processing for the special purposes
1702. 35Paragraph 35
1703. Offences
1704. 36Paragraph 36
1705. Powers of entry
1706. 37Paragraph 37
1707. Monetary penalties
1708. 38Paragraph 38
1709. Appeals
1710. 39Paragraph 39
1711. Exemptions
1712. 40Paragraph 40
1713. Tribunal Procedure Rules
1714. 41Paragraph 41
1715. Obstruction etc
1716. 42Paragraph 42
1717. Enforcement etc under the 2014 Regulations
1718. 43Paragraph 43
1719. Part 8: Enforcement etc under this Act
1720. Information notices
1721. 44Paragraph 44
1722. Powers of entry
1723. 45Paragraph 45
1724. Tribunal Procedure Rules
1725. 46Paragraph 46
1726. Part 9: Other enactments
1727. Powers to disclose information to the Commissioner
1728. 47Paragraph 47
1729. Codes etc required to be consistent with the Commissioner's data-sharing code
1730. 48Paragraph 48
1731. 49Paragraph 49
1732. Consumer Credit Act 1974
1733. 50Paragraph 50
1734. Freedom of Information Act 2000
1735. 51Paragraph 51
1736. 52Paragraph 52
1737. 53Paragraph 53
1738. 54Paragraph 54
1739. 55Paragraph 55
1740. Freedom of Information (Scotland) Act 2002
1741. 56Paragraph 56
1742. Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
1743. 57Paragraph 57
1744. Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)
1745. 58Paragraph 58
1746. Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))
1747. 59Paragraph 59
1748. Environmental Information Regulations 2004 (S.I. 2004/3391)
1749. 60Paragraph 60
1750. Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
1751. 61Paragraph 61
1752. Schedule 21: Further transitional provision etc
1753. Part 1: Interpretation
1754. 1The applied GPDR
1755. Part 2: Continuation of existing acts etc
1756. 2Merger of the directly applicable GDPR and the applied GDPR
1757. 3Paragraph 3
1758. Part 3: Transfers to third countries and international organisations
1759. 4UK GDPR: transfers approved by regulations
1760. 5Paragraph 5
1761. 6Paragraph 6
1762. 7UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses Repealed
1763. 8Paragraph 8 Repealed
1764. 9UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules
1765. 10Part 3 (law enforcement processing): transfers approved by regulations
1766. 11Paragraph 11
1767. 12Paragraph 12
1768. Part 4: Repeal of provisions in Chapter 3 of Part 2
1769. 13Applied GDPR: power to make provision in consequence of GDPR regulations
1770. 14Applied GDPR: national security certificates
1771. Part 5: The Information Commission
1772. 15Confidentiality of information
1773. Part 6: Enforcement
1774. 16GDPR: maximum amount of penalties
1775. 17GDPR: right to an effective remedy against the Commissioner