Regulation 4 Transitional and saving provisions relating to the national security exemption

(1)

Section 88 of the 2025 Act does not affect the application of—

(a)

Chapter 3 of Part 3 of the 2018 Act, in a case in which a controller received a request under a section of that Chapter before the relevant time;

(b)

section 51 (exercise of rights through the Commissioner) of the 2018 Act, in a case in which the Commissioner received a request under that section before the relevant time;

(c)

sections 67 and 68 (obligations relating to personal data breaches) of the 2018 Act, in a case in which a personal data breach (within the meaning given by section 33(2) of the 2018 Act) occurred before the relevant time^f1;

(d)

section 119 (inspection of personal data) of the 2018 Act, in a case in which a controller received written notice under that section before the relevant time;

(e)

Schedule 13 (other general functions of the Commissioner) to the 2018 Act, in a case in which the Commissioner^f2—

(i)

commenced enforcement action pursuant to paragraph 1(1)(a) of that Schedule, before the relevant time; or

(ii)

received information under paragraph 1(1)(g) of that Schedule, before the relevant time;

(f)

sections 142 to 154 (enforcement) of, and Schedule 15 (powers of entry and inspection) to, the 2018 Act, in relation to any of the following which is received by a controller before the relevant time^f3—

(i)

an information notice;

(ii)

an assessment notice;

(iii)

an enforcement notice;

(g)

section 173 (alteration of personal data to prevent disclosure) of the 2018 Act, in a case in which a controller received a request pursuant to that section before the relevant time^f4;

(h)

section 187 (representation of data subjects) of the 2018 Act, in a case in which, before the relevant time, a body or other organisation authorised to act on behalf of a data subject in accordance with that section^f5—

(i)

made a complaint to the Commissioner under section 165 (complaints by data subjects)^f6;

(ii)

made an application to the Tribunal under section 166 (orders to progress complaints)^f7;

(iii)

made an application to the court under section 167 (compliance orders)^f8; or

(iv)

brought judicial review proceedings.

(2)

Section 88 of the 2025 Act does not affect the application of section 79(2) to (13) of the 2018 Act to a certificate issued under section 79(1) before the relevant time.

Annotations

Footnotes

f1: Section 67 was amended by S.I. 2019/419.
f2: Schedule 13 was amended by S.I. 2019/419.
f3: Sections 142 and 143 were amended by the Data (Use and Access) Act 2025, section 97 and S.I. 2019/419. Sections 145 and 148 were amended by the Data (Use and Access) Act 2025, section 97.
f4: Section 173 was amended by S.I. 2019/419.
f5: Section 187 was amended by S.I. 2019/419.
f6: Section 165 was amended by S.I. 2019/419.
f7: Section 166 was amended by S.I. 2019/419.
f8: Section 167 was amended by S.I. 2019/419.