Regulation 32A Codes of conductF1

(1)

The F2Commission must encourage representative bodies to produce codes of conduct intended to contribute to compliance with these Regulations.

(2)

Under paragraph (1), the Commission must encourage representative bodies to produce codes which take account of, among other things, the specific features of different sectors.

(3)

A code of conduct described in paragraph (1) may, for example, make provision with regard to—

(a)

rights and obligations under these Regulations;

(b)

out-of-court proceedings and other dispute resolution procedures for resolving disputes arising in connection with these Regulations.

(4)

The F3Commission must encourage representative bodies to submit codes of conduct described in paragraph (1) to the Commission in draft.

(5)

Where a representative body does so, the Commission must—

(a)

provide the representative body with an opinion on whether the code correctly reflects the requirements of these Regulations,

(b)

decide whether to approve the code, and

(c)

if the code is approved, register and publish the code.

(6)

The Commission may only approve a code if, among other things—

(a)

the code contains a mechanism for monitoring whether persons who undertake to apply the code comply with its provisions, and

(b)

in relation to persons other than public bodies, the mechanism involves monitoring by a body which is accredited for that purpose by the Commission under regulation 32B.

(7)

In relation to amendments of a code of conduct that is for the time being approved under this regulation—

(a)

paragraphs (4) and (5) apply as they apply in relation to a code, and

(b)

the requirements in paragraph (6) must be satisfied by the code as amended.

(8)

A code of conduct described in paragraph (1) may be contained in the same document as a code of conduct described in Article 40 of the UK GDPR (and a provision contained in such a document may be a provision of both codes).

(9)

In this regulation—

“public body” has the meaning given in section 7 of the Data Protection Act 2018 (for the purposes of the UK GDPR);
“representative body” means an association or other body representing categories of—
1. (a)
  communications providers, or
2. (b)
  other persons engaged in activities regulated by these Regulations;
“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Annotations

Textual amendments

F1: Regs. 32A-32C inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 116(2), 142(1); S.I. 2026/82, reg. 2(z)
F2: Word in reg. 32A(1)(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 6(3)(4)(h); S.I. 2026/1015, reg. 2(c)
F3: Word in reg. 32A(4)-(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 6(3)(4)(h); S.I. 2026/1015, reg. 2(c)