An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes.
Enacted
[19th June 2025]
Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—
1This Part confers powers on the Secretary of State and the Treasury to make provision in connection with access to customer data and business data.2In this Part—
“business data”, in relation to a trader, means—
information about goods, services and digital content supplied or provided by the trader,
information relating to the supply or provision of goods, services and digital content by the trader (such as, for example, information about—
where goods, services or digital content are supplied or provided,
prices or other terms on which they are supplied or provided,
how they are used, or
their performance or quality),
information relating to feedback about the goods, services or digital content (or their supply or provision), and
information relating to the provision of information described in paragraphs (a) to (c) to a person in accordance with data regulations;
“customer data” means information relating to a customer of a trader, including—
information relating to goods, services and digital content supplied or provided by the trader to the customer or to another person at the customer’s request (such as, for example, information about—
prices or other terms on which goods, services or digital content are supplied or provided to the customer or the other person,
how they are used by the customer or the other person, or
their performance or quality when used by the customer or the other person), and
information relating to the provision of information described in paragraph (a), or of other information relating to a customer of a trader, to a person in accordance with data regulations;
“data holder”, in relation to customer data or business data of a trader, means—
the trader, or
a person who, in the course of a business, processes the data;
“data regulations” means regulations under section 2 or 4 (and see section 23);
“trader” means a person who supplies or provides goods, services or digital content in the course of a business, whether acting personally or through another person acting in the trader’s name or on the trader’s behalf.
3For the purposes of this Part, a person (“C”) is a customer of a trader (“T”) if C has at any time—apurchased goods, services or digital content supplied or provided by T (whether for use by C or another person),bbeen supplied or provided by T with goods, services or digital content purchased from T by another person, orcotherwise received goods, services or digital content free of charge from T.4In subsection (3), the references to purchase, supply, provision or receipt of goods, services or digital content at any time include purchase, supply, provision or receipt before this section comes into force.5In subsections (3) and (4), references to purchasing goods, services or digital content include entering into an agreement to do so.6In this Part—aa reference to providing customer data or business data to a person (however expressed) includes a reference to providing the person with access to such data or with the ability to provide other persons with access to such data, andba reference to a person receiving customer data or business data (however expressed) includes a reference to a person obtaining access to such data or the ability to provide other persons with access to such data.
I94I4192 Power to make provision in connection with customer data¶
1The Secretary of State or the Treasury may by regulations make provision requiring a data holder to provide customer data—ato the customer, at the customer’s request, orbto a person of a specified description who is authorised by the customer to receive the data (an “authorised person”), at the customer’s request or at the authorised person’s request.2In this Part, in relation to customer data, “third party recipient” means a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)).3The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder—ato produce, collect or retain, or arrange for the production, collection or retention of, customer data;bto make changes to customer data, including to require rectification of inaccurate customer data, at the request of a customer or authorised person.4The Secretary of State or the Treasury may by regulations make provision for a person who is an authorised person in relation to customer data to take, on the customer’s behalf, action that the customer could take in relation to goods, services or digital content supplied or provided by a person who is, or has been, a data holder in relation to the customer data.5In deciding whether to make regulations under this section, the Secretary of State or the Treasury must have regard to (among other things)—athe likely effects for existing and future customers,bthe likely effects for data holders,cthe likely effect on small businesses and micro businesses,dthe likely effect on innovation in the supply or provision of goods, services and digital content affected by the regulations or other goods, services and digital content, andethe likely effect on competition in markets for goods, services and digital content affected by the regulations or other markets.
1This section is about provision that regulations under section 2 may (among other things) contain.2The regulations may include—aprovision about the procedure by which customers authorise persons to receive customer data or to do other things;bprovision restricting the persons that may be authorised to persons that comply with specified conditions;cprovision for a specified person to decide whether a person satisfies the conditions for authorisation (and see section 6 for further provision about decision-makers).3The regulations may make provision about requests relating to customer data, including provision about the circumstances in which a data holder may or must refuse to act on a request.4The regulations may make provision about the providing of customer data and the taking of action described in section 2(4), including—aprovision requiring a data holder to provide customer data on one or more occasions, for a specified period or at specified intervals;bprovision requiring a data holder, customer or third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;cprovision requiring a data holder or third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;dprovision requiring a data holder or third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;eprovision about interface bodies (see section 7).5The regulations may include—aprovision enabling or requiring a data holder to produce, collect or retain, or arrange for the production, collection or retention of, records of customer data provided in accordance with the regulations;bprovision enabling or requiring a third party recipient to produce or retain, or arrange for the production or retention of, records of customer data received in accordance with the regulations.6The regulations may make provision requiring a person who, in the course of a business, processes customer data of a trader to assist, or take specified steps to assist, the trader in complying with regulations under this Part.7The regulations may make provision about the processing of customer data provided to a third party recipient in accordance with the regulations, including—aprovision requiring a third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;bprovision requiring a third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;cprovision requiring a third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;dprovision about interface bodies (see section 7);eprovision about further disclosure of the data, including provision for a person to whom customer data is further disclosed to be subject to—isome or all of the obligations imposed on a third party recipient by the regulations in relation to the customer data;iiconditions imposed by the third party recipient.8The regulations may make provision enabling or requiring a data holder or a third party recipient to publish specified information relating to the rights and obligations of persons under the regulations, including—ainformation about the rights of customers in relation to customer data processed by the data holder or a third party recipient;binformation about the activities carried out by the data holder or a third party recipient in performance of their obligations under the regulations.9The regulations may make provision about complaints, including provision requiring data holders or third party recipients to implement procedures for the handling of complaints.10The regulations may make provision about procedures for the resolution of disputes, including—aprovision appointing, or providing for the appointment of, a person to determine disputes;bprovision about the person’s powers when determining disputes;cprovision about the effect of decisions relating to disputes;dprovision about the review of decisions relating to disputes;eprovision about appeals to a court or tribunal.11In subsections (4)(d) and (7)(c), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
I35I2734 Power to make provision in connection with business data¶
1The Secretary of State or the Treasury may by regulations make provision requiring a data holder to publish business data or to provide business data—ato a customer of the trader to whom the business data relates, orbto another person of a specified description.2In this Part, in relation to business data, “third party recipient” means a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)).3The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder to produce, collect or retain, or arrange for the production, collection or retention of, business data.4The Secretary of State or the Treasury may by regulations—amake provision requiring a public authority that is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), or a person appointed by such a public authority to do something with the business data, to publish business data or to provide business data—ito a customer of the trader to whom the business data relates, oriito another person of a specified description,bmake provision requiring a person who is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), and who is appointed by a public authority to do something with the business data, to publish or provide business data as described in paragraph (a)(i) or (ii),cin relation to the public authority, or the appointed person referred to in paragraph (a) or (b), make any provision that could be made in relation to a data holder, in connection with business data, in reliance on subsection (3) or sections 5 to 21, other than provision imposing a levy on the public authority or person, anddin relation to a person to whom the public authority or appointed person is required to provide business data by virtue of provision made under paragraph (a) or (b), other than a customer described in paragraph (a)(i), make any provision that could be made in relation to a third party recipient in reliance on sections 5 to 21.5In deciding whether to make regulations under this section, the Secretary of State or the Treasury must have regard to (among other things)—athe likely effects for existing and future customers,bthe likely effects for data holders,cthe likely effect on small businesses and micro businesses,dthe likely effect on innovation in the supply or provision of goods, services and digital content affected by the regulations or other goods, services and digital content, andethe likely effect on competition in markets for goods, services and digital content affected by the regulations or other markets.
1This section is about provision that regulations under section 4 may (among other things) contain.2The regulations may require business data to be provided on request and make provision about requests, including—aprovision for requests to be made by a customer, a third party recipient or another person;bprovision about the circumstances in which a data holder may or must refuse to act on a request.3The regulations may make provision requiring business data to be provided to customers, or third party recipients, who are approved to receive it, including—aprovision restricting the persons that may be approved to persons that comply with specified conditions;bprovision for a specified person to decide whether a person satisfies the conditions for approval (and see section 6 for further provision about decision-makers).4The regulations may make provision about the providing or publishing of business data, including—aprovision requiring a data holder to provide or publish business data on one or more occasions, for a specified period or at specified intervals;bprovision requiring a data holder, customer or third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;cprovision requiring a data holder or third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;dprovision requiring a data holder or third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;eprovision about interface bodies (see section 7).5The regulations may include—aprovision enabling or requiring a data holder to produce, collect or retain, or arrange for the production, collection or retention of, records of business data provided in accordance with the regulations;bprovision enabling or requiring a third party recipient to produce or retain, or arrange for the production or retention of, records of business data received in accordance with the regulations.6The regulations may make provision requiring a person who, in the course of a business, processes business data of a trader to assist, or take specified steps to assist, the trader in complying with regulations under this Part.7The regulations may make provision about the processing of business data provided to a third party recipient in accordance with the regulations, including—aprovision requiring a third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;bprovision requiring a third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;cprovision requiring a third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;dprovision about interface bodies (see section 7);eprovision about further disclosure of the data, including provision for a person to whom business data is further disclosed to be subject to some or all of the obligations imposed on customers or third party recipients by the regulations in relation to the business data.8The regulations may make provision enabling or requiring a data holder or a third party recipient to publish specified information relating to the rights and obligations of persons under the regulations, including information about the activities carried out by the data holder or third party recipient in performance of their obligations under the regulations.9The regulations may make provision about complaints, including provision requiring data holders or third party recipients to implement procedures for the handling of complaints.10The regulations may make provision about procedures for the resolution of disputes, including—aprovision appointing, or providing for the appointment of, a person to determine disputes;bprovision about the person’s powers when determining disputes;cprovision about the effect of decisions relating to disputes;dprovision about the review of decisions relating to disputes;eprovision about appeals to a court or tribunal.11In subsections (4)(d) and (7)(c), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
1This section is about the provision about decision-makers that regulations under section 2 or 4 may or must (among other things) contain.2In this Part, “decision-maker” means a person who is authorised or required to take a decision described in section 3(2)(c) (authorisation) or 5(3)(b) (approval).3The regulations may make provision about the appointment of a decision-maker.4The regulations may make provision enabling or requiring a decision-maker to suspend or revoke a decision.5The regulations may confer powers on a decision-maker for the purpose of monitoring compliance with conditions for authorisation or approval (“monitoring powers”) (and see section 8 for provision about enforcement of requirements imposed in exercise of those powers).6The monitoring powers that may be conferred on a decision-maker include powers to require the provision of documents or information (but such powers are subject to the restrictions in section 9 as well as any restrictions included in the regulations).7The regulations must make provision about the rights of persons affected by the exercise of a decision-maker’s functions under the regulations and such provision may include (among other things)—aprovision about the review of decision-makers’ decisions;bprovision about appeals to a court or tribunal.8The regulations may make provision about complaints, including provision requiring a decision-maker to implement procedures for the handling of complaints.9The regulations may make provision enabling or requiring a decision-maker to publish, or provide to a specified person, specified documents or information relating to the exercise of the decision-maker’s functions.10The regulations may make provision for a decision-maker to arrange for its monitoring powers to be exercised by another person.11The regulations may—aprovide for functions under the regulations to be exercisable by more than one decision-maker (whether jointly or concurrently);bwhere functions of decision-makers are exercisable concurrently—iprovide for one of the decision-makers to be the lead decision-maker;iirequire the other decision-makers to consult the lead decision-maker before exercising the functions in a particular case;iiiprovide for the lead decision-maker to give directions as to which decision-maker is to exercise a function in a particular case.12The regulations may make provision enabling or requiring a decision-maker—ato produce guidance about how it proposes to exercise its functions under the regulations (including provision enabling or requiring decision-makers with functions exercisable jointly or concurrently to produce joint guidance),bto publish the guidance, andcto provide copies to specified persons.
1This section is about the provision that regulations under section 2 or 4 may (among other things) contain about bodies with one or more of the following tasks—aestablishing a facility or service used, or capable of being used, for providing, publishing or otherwise processing customer data or business data or for taking action described in section 2(4) (referred to in this Part as an “interface”);bsetting standards, or making other arrangements, relating to, or to the use of, an interface (referred to in this Part as “interface standards” and “interface arrangements”);cmaintaining or managing an interface, interface standards or interface arrangements.2Such bodies are referred to in this Part as “interface bodies”.3The regulations may—arequire a data holder or a third party recipient to set up an interface body;bmake provision about the type of body to be set up.4In relation to an interface body (whether or not it is required to be set up by regulations under section 2 or 4), the regulations may—amake provision about the body’s composition and governance;bmake provision requiring a data holder or a third party recipient to provide, or arrange for, assistance for the body;cimpose other requirements relating to the body on a person who is required to set it up or to provide, or arrange for, assistance for the body;dmake provision requiring the body to carry on all or part of a task described in subsection (1);emake provision requiring the body to do other things in connection with its interface, interface standards or interface arrangements;fmake provision about how the body carries out its functions (such as, for example, provision about the body’s objectives or matters to be taken into account by the body);gconfer powers on the body for the purpose of monitoring use of its interface, interface standards or interface arrangements (“monitoring powers”) (and see section 8 for provision about enforcement of requirements imposed in exercise of those powers);hmake provision for the body to arrange for its monitoring powers to be exercised by another person;imake provision about the rights of persons affected by the exercise of the body’s functions under the regulations, including (among other things)—iprovision about the review of decisions made in exercise of those functions;iiprovision about appeals to a court or tribunal;jmake provision about complaints, including provision requiring the body to implement procedures for the handling of complaints;kmake provision enabling or requiring the body to publish, or provide to a specified person, specified documents or information relating to its interface, interface standards or interface arrangements;lmake provision enabling or requiring the body to produce guidance about how it proposes to exercise its functions under the regulations, to publish the guidance and to provide copies to specified persons.5The monitoring powers that may be conferred on an interface body include power to require the provision of documents or information (but such powers are subject to the restrictions in section 9 as well as any restrictions included in the regulations).6Examples of facilities or services referred to in subsection (1) include dashboard services, other electronic communications services and application programming interfaces.7In subsection (4)(b) and (c), the references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
I153I628 Enforcement of regulations under this Part¶
1The Secretary of State or the Treasury may by regulations make provision—afor the purpose of monitoring compliance with regulations under this Part or requirements imposed in exercise of a power conferred by such regulations, andbfor the enforcement of such regulations or requirements,including provision for monitoring or enforcement by a specified public authority.2In this Part, “enforcer” means a public authority that is authorised or required to carry out monitoring or enforcement described in subsection (1).3The following subsections make provision about what regulations under subsection (1) may or must (among other things) contain (and see sections 9 and 10).4The regulations may confer powers of investigation on an enforcer, including—apowers to require the provision of documents or information,bpowers to require an individual to attend at a place and answer questions, andcpowers of entry, inspection, search and seizure,but such powers are subject to the restrictions in section 9 (as well as any restrictions included in the regulations).5The regulations may—amake provision enabling an enforcer to issue a notice (“a compliance notice”) requiring compliance with—iregulations under this Part;iia condition for authorisation or approval (referred to in sections 3(2) and 5(3));iiiany other requirement imposed in exercise of a power conferred by regulations under this Part;bmake provision for the enforcement of compliance notices, including provision for their enforcement as if they were orders of a court or tribunal;cmake provision enabling an enforcer to publish a statement to the effect that the enforcer considers that a person is not complying with—ia requirement imposed by regulations under this Part,iia requirement imposed by a compliance notice, oriiiany other requirement imposed in exercise of a power conferred by regulations under this Part.6The regulations may make provision creating offences punishable with an unlimited fine, or a fine not exceeding a specified amount, in respect of—athe provision of false or misleading information in response to a request made in accordance with regulations under this Part;ban act or omission (including falsification) which prevents an enforcer, an interface body or a decision-maker from accessing information, documents, equipment or other material.7The regulations may make provision enabling a financial penalty to be imposed by an enforcer in respect of—athe provision of false or misleading information in response to a request made in accordance with regulations under this Part;ba failure to comply with a requirement imposed by regulations under this Part;ca failure to comply with a requirement imposed by a compliance notice;da failure to comply with any other requirement imposed in exercise of a power conferred by regulations under this Part;and see section 10 for further provision about financial penalties.8The regulations may make provision about the rights of persons affected by the exercise of an enforcer’s functions under the regulations, including—aprovision about the review of a decision made in exercise of those functions;bprovision about appeals to a court or tribunal.9The regulations may make provision about complaints, including provision requiring an enforcer to implement procedures for the handling of complaints.10The regulations may make provision enabling or requiring an enforcer to publish, or to provide to a specified person, specified documents or information relating to monitoring or enforcement described in subsection (1), including—adocuments or information relating to the exercise of the enforcer’s functions, andbdocuments or information relating to convictions for offences.11The regulations may make provision for an enforcer to arrange for its powers of investigation under the regulations to be exercised by another person.12The regulations may—aprovide for functions under the regulations to be exercisable by more than one enforcer (whether jointly or concurrently);bwhere functions of enforcers are exercisable concurrently—iprovide for one of the enforcers to be the lead enforcer;iirequire the other enforcers to consult the lead enforcer before exercising the functions in a particular case;iiiprovide for the lead enforcer to give directions as to which enforcer is to exercise a function in a particular case.13The regulations may make provision enabling or requiring an enforcer—ato produce guidance about how it proposes to exercise its functions under the regulations (including provision enabling or requiring enforcers with functions exercisable jointly or concurrently to produce joint guidance),bto publish the guidance, andcto provide copies to specified persons.
I284I3119 Restrictions on powers of investigation etc¶
1Regulations under this Part may not—aauthorise entry to a private dwelling without a warrant issued by a justice, orbrequire a person to provide information within subsections (2) to (7) to a decision-maker, an interface body or an enforcer.2Information is within this subsection if requiring a person to provide the information would involve an infringement of the privileges of either House of Parliament.3Information is within this subsection if it is information in respect of a communication which is made—abetween a professional legal adviser and the adviser’s client, andbin connection with the giving of legal advice to the client with respect to obligations, liabilities or rights imposed or conferred by or under regulations made under this Part.4Information is within this subsection if it is information in respect of a communication which is made—abetween a professional legal adviser and the adviser’s client or between such an adviser or client and another person,bin connection with, or in contemplation of, proceedings under or arising out of regulations made under this Part (including proceedings arising out of the exercise of powers conferred by such regulations), andcfor the purposes of such proceedings.5In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.6Information is within this subsection if requiring a person to provide the information would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.7The reference to an offence in subsection (6) does not include an offence under—aregulations made under this Part;bsection 5 of the Perjury Act 1911 (false statements made otherwise than on oath);csection 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);dArticle 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).8An oral or written statement provided by a person in response to a request for information made by a decision-maker, an interface body or an enforcer in accordance with regulations under this Part may not be used in evidence against that person on a prosecution for an offence (other than an offence under regulations made under this Part) unless in the proceedings—ain giving evidence the person provides information inconsistent with the statement, andbevidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person’s behalf.9In this section, “justice” means—ain England and Wales, a justice of the peace,bin Scotland, a sheriff or summary sheriff, andcin Northern Ireland, a lay magistrate.
1This section is about provision that regulations under this Part conferring power on an enforcer to impose a financial penalty may or must (among other things) contain.2The regulations must provide for the amount of a financial penalty to be—aa specified amount or an amount determined in accordance with the regulations, orban amount not exceeding such an amount,unless section 16 confers power to provide otherwise.3The regulations must include provision—arequiring an enforcer to produce guidance about how the enforcer proposes to exercise any discretion to determine the amount of a financial penalty and to have regard to such guidance in exercising its discretion;brequiring an enforcer to publish the guidance;crequiring an enforcer, before imposing a financial penalty on a person, to give the person written notice (a “notice of intent”) of the proposed financial penalty;densuring that the person is given an opportunity to make representations about the proposed financial penalty;erequiring the enforcer, after the period for making representations, to decide whether to impose the financial penalty;frequiring the enforcer, if they decide to impose the financial penalty, to give the person notice in writing (a “final notice”) imposing the penalty;genabling a person on whom a financial penalty is imposed to appeal to a court or tribunal in accordance with the regulations;has to the powers of the court or tribunal on such an appeal.4The regulations may include provision—arequiring or enabling an enforcer to provide copies of guidance described in subsection (3)(a) to specified persons;benabling a notice of intent or final notice to be withdrawn or amended;crequiring an enforcer to withdraw a final notice in specified circumstances;dfor a financial penalty to be increased in the event of late payment by—ia specified amount or an amount determined in accordance with the regulations, oriian amount not exceeding such an amount;eas to how financial penalties are recoverable;fabout what must or may be done with amounts paid as penalties.
1The Secretary of State or the Treasury may by regulations—amake provision enabling a person listed in subsection (2), or a person acting on their behalf, to require other persons to pay fees in connection with activities described in subsection (3), andbmake provision about what must or may be done with amounts paid as fees.2Those persons are—adata holders;bdecision-makers;cinterface bodies;denforcers;eother persons on whom duties are imposed, or powers are conferred, by or under regulations made under this Part.3Those activities are performing duties, or exercising powers, imposed or conferred on the person listed in subsection (2) by or under regulations made under this Part.4Regulations under subsection (1)—amay only provide for a fee to be payable by persons that appear to the Secretary of State or the Treasury to be capable of being directly affected by the performance of duties, or the exercise of powers, imposed or conferred by or under regulations made under this Part;bmay provide for the amount of a fee to be an amount which is intended to exceed the cost of the things in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost).5Regulations under subsection (1) must provide for the amount of a fee to be—aa specified amount or an amount determined in accordance with the regulations, orban amount not exceeding such an amount,unless section 15 confers power to provide otherwise.6Regulations under subsection (1) may provide for the amount, or maximum amount, of a fee to increase at specified times and by—aa specified amount or an amount determined in accordance with the regulations, orban amount not exceeding such an amount.7Regulations under subsection (1) enabling a person to determine the amount of a fee must require the person to publish information about the amount and how it is determined.8Regulations under subsection (1) may (among other things) make provision about—ainterest on any unpaid amounts;bthe recovery of unpaid amounts.9The Secretary of State or the Treasury may by regulations make provision about whether a person listed in subsection (2), or a person acting on their behalf, who could require payment in connection with an activity described in subsection (3) otherwise than in reliance on regulations under subsection (1) may do so.10Where duties or powers are imposed or conferred—aon a person in their capacity as a third party recipient by or under regulations made under this Part, other than regulations made in reliance on section 4(4)(a), (b) or (c), orbon a person in their capacity as a person described in section 4(4)(d) by or under regulations made under this Part,nothing in this section, or in regulations under subsection (1) or (9), prevents the person, or a person acting on their behalf, from requiring payment in connection with the performance or exercise of those duties or powers, or restricts their ability to do so, where the person could do so otherwise than in reliance on regulations under subsection (1).11Examples of requiring payment otherwise than in reliance on regulations under subsection (1) include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).
1The Secretary of State or the Treasury may by regulations—aimpose, or provide for a specified public authority to impose, a levy on data holders or third party recipients for the purpose of meeting expenses described in subsection (2), andbmake provision about what must or may be done with funds raised by means of the levy.2Those expenses are expenses incurred, or to be incurred, during a period by a person listed in subsection (3), or a person acting on their behalf, in performing duties, or exercising powers, imposed or conferred on the person listed in subsection (3) by or under regulations made under this Part.3Those persons are—adecision-makers;binterface bodies;cenforcers;dpublic authorities subject to requirements imposed by regulations made in reliance on section 4(4).4Regulations under subsection (1) may only provide for a levy in respect of expenses of a person to be imposed on data holders or third party recipients that appear to the Secretary of State or the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the person by or under regulations made under this Part.5Regulations under subsection (1) providing for a specified public authority to impose a levy must—amake provision about how the rate of the levy is to be determined;bmake provision about how the period in respect of which the levy is payable is to be determined;crequire the public authority to publish information about the rate, the period and how they are determined.6Regulations under subsection (1) may (among other things) make provision about—ainterest on any unpaid amounts payable by way of a levy;bthe recovery of such unpaid amounts.
1The Secretary of State or the Treasury may give financial assistance to a person for the purpose of—ameeting expenses incurred, or to be incurred, by the person in performing duties, or exercising powers, imposed or conferred by or under regulations made under this Part, orbexercising other functions in connection with such regulations.2But subsection (1) does not enable financial assistance to be provided to a person listed in subsection (3) or to a person acting on their behalf.3Those persons are—adata holders,bcustomers, orcthird party recipients, other than a third party recipient that is a public authority subject to requirements imposed by regulations made in reliance on section 4(4).4The financial assistance may be given on such terms and conditions as the Secretary of State or the Treasury considers appropriate.5In this section, “financial assistance” means any kind of financial assistance whether actual or contingent, including a grant, loan, guarantee or indemnity, but does not include buying a company’s share capital.
I299I20714 The FCA and financial services interfaces¶
1The Treasury may by regulations make provision enabling or requiring the Financial Conduct Authority (referred to in this Part as “the FCA”) to make rules—arequiring financial services providers described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements, when providing or receiving customer data or business data which is required to be provided by or to the financial services provider by data regulations;brequiring persons described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements, when the person, in the course of a business, receives, from a financial services provider, customer data or business data which is required to be provided to the person by data regulations;crequiring section 2(4) actors described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements when taking, facilitating or doing other things in connection with relevant financial services action;dimposing interface-related requirements on a description of person falling within subsection (3).2Such rules are referred to in this Part as “FCA interface rules”.3The following persons fall within this subsection—aan interface body linked to the financial services sector;ba person required by regulations made in reliance on section 7 to set up an interface body linked to the financial services sector;ca person who uses an interface, complies with interface standards or participates in interface arrangements linked to the financial services sector or who is required to do so by data regulations or rules made by virtue of regulations under subsection (1)(a), (b) or (c).4For the purposes of this section, requirements are interface-related if they relate to—athe composition, governance or activities of an interface body linked to the financial services sector,ban interface, interface standards or interface arrangements linked to the financial services sector, orcthe use of such an interface, compliance with such interface standards or participation in such interface arrangements.5For the purposes of this section—aan interface body is linked to the financial services sector to the extent that its interface, interface standards or interface arrangements are linked to the financial services sector;binterfaces, interface standards and interface arrangements are linked to the financial services sector to the extent that they are used, or intended to be used, by financial services providers (whether or not they are used, or intended to be used, by other persons).6The Treasury may by regulations make provision enabling or requiring the FCA to impose requirements on a person to whom FCA interface rules apply (referred to in this Part as “FCA additional requirements”) where the FCA considers it appropriate to impose the requirement—ain response to a failure, or likely failure, by the person to comply with an FCA interface rule or FCA additional requirement, orbin order to advance a purpose which the FCA is required to advance when exercising functions conferred by regulations under this section (see section 15(3)(a)).7Regulations under subsection (6) may, for example, provide for the FCA to impose requirements by giving a notice or direction.8The restrictions in section 9 apply in connection with FCA interface rules and FCA additional requirements as they apply in connection with regulations under this Part.9In section 9 as so applied—athe references in subsections (1)(b) and (8) to an enforcer include the FCA, andbthe references in subsections (3) and (4) to regulations made under this Part include FCA interface rules and FCA additional requirements.10In this section—
“financial services provider” means a person providing financial services;
“prescribed” means prescribed in FCA interface rules;
“relevant financial services action” means action described in section 2(4) taken in relation to services or digital content provided or supplied by a financial services provider;
“section 2(4) actor” means—
a person who, in reliance on regulations under subsection (4) of section 2, takes action described in that subsection;
a data holder or other person who facilitates or does other things in connection with such action.
I158I22015 The FCA and financial services interfaces: supplementary¶
1This section is about provision that regulations under section 14 may or must (among other things) contain.2The regulations—amay require or enable the FCA to impose interface-related requirements that could be imposed by regulations made in reliance on section 7(4) or (5), butbmay not require or enable the FCA to require a person to set up an interface body.3The regulations must—arequire the FCA, so far as is reasonably possible, to exercise functions conferred by the regulations in a manner which is compatible with, or which advances, one or more specified purposes;bspecify one or more matters to which the FCA must have regard when exercising functions conferred by the regulations;cif they require or enable the FCA to make rules, make provision about the procedure for making rules, including provision requiring such consultation with persons likely to be affected by the rules or representatives of such persons as the FCA considers appropriate.4The regulations may—arequire the FCA to carry out an analysis of the costs and benefits that will arise if proposed rules are made or proposed changes are made to rules and make provision about what the analysis must include;brequire the FCA to publish rules or changes to rules and to provide copies to specified persons;cmake provision about the effect of rules, including provision about circumstances in which rules are void and circumstances in which a person is not to be taken to have contravened a rule;dmake provision enabling or requiring the FCA to modify or waive rules as they apply to a particular case;emake provision about the procedure for imposing FCA additional requirements;fmake provision enabling or requiring the FCA to produce guidance about how it proposes to exercise its functions under the regulations, to publish the guidance and to provide copies to specified persons.5The regulations may require or enable the FCA to impose the following types of requirement on a person as FCA additional requirements—aa requirement to review the person’s conduct;ba requirement to take remedial action;ca requirement to make redress for loss or damage suffered by others as a result of the person’s conduct.6The regulations may require or enable FCA interface rules to require a person listed in subsection (7) to pay fees to an interface body or another person listed in that subsection, or to a person acting on behalf of such a body or person, in connection with activities described in subsection (8).7Those persons are—apersons falling within section 14(3)(b) or (c);bfinancial services providers.8Those activities are performing or exercising—aduties or powers imposed or conferred on the interface body or person listed in subsection (7) by FCA interface rules, andbother duties or powers imposed or conferred on that body or person by or under regulations made under this Part.9Regulations made in reliance on subsection (6)—amay enable rules to provide for the amount of a fee to be an amount which is intended to exceed the cost of the things in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost);bmay require or enable rules to make provision about the amount, or maximum amount, of a fee, including provision about how a fee is to be determined;cmay require or enable rules to make provision about the amount, or maximum amount, by which the amount, or maximum amount, of a fee must or may increase and the times at which it must or may increase;dmust require rules, where relevant, to require a person who determines an amount referred to in paragraph (b) or (c) to publish information about the amount and how it is determined;emay require or enable rules to make provision about what must or may be done with amounts paid as fees;fmay require or enable rules to make provision about—iinterest on any unpaid amounts;iithe recovery of unpaid amounts.10Regulations under section 14 may enable FCA interface rules to make provision about whether an interface body or a person listed in subsection (7), or a person acting on behalf of such a body or person, who could require payment in connection with an activity described in subsection (8) otherwise than in reliance on FCA interface rules may do so.11Examples of requiring payment otherwise than in reliance on FCA interface rules include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).12Regulations under section 14 may provide that powers to make FCA interface rules include powers to do things described in section 21(1)(a) to (h) (supplementary powers) (ignoring the restriction in relation to fees in section 21(3)).13In this section, “financial services provider” and “interface-related” have the meaning given in section 14.14The reference in subsection (5)(c) to making redress includes—apaying interest, andbproviding redress in the form of a remedy or relief which could not be awarded in legal proceedings.
I315I29116 The FCA and financial services interfaces: penalties and levies¶
1Subsections (2) and (3) are about the provision that regulations made by the Treasury under this Part providing for the FCA to enforce requirements under FCA interface rules may (among other things) contain in relation to financial penalties.2The regulations may require or enable the FCA—ato set the amount or maximum amount of, or of an increase in, a penalty imposed in respect of failure to comply with a requirement imposed by the FCA in exercise of a power conferred by regulations under section 14 (whether imposed by means of FCA interface rules or an FCA additional requirement), orbto set the method for determining such an amount.3Regulations made in reliance on subsection (2)—amust require the FCA to produce and publish a statement of its policy with respect to the amount of the penalties;bmay require the policy to include specified matters;cmay make provision about the procedure for producing the statement;dmay require copies of the statement to be provided to specified persons;emay require the FCA to have regard to a statement published in accordance with the regulations.4The Treasury may by regulations—aimpose, or provide for the FCA to impose, a levy on data holders or third party recipients for the purpose of meeting expenses incurred, or to be incurred, during a period by the FCA, or by a person acting on the FCA’s behalf, in performing duties, or exercising powers, imposed or conferred on the FCA by regulations under section 14, andbmake provision about what must or may be done with funds raised by means of the levy.5Regulations under subsection (4) may only provide for a levy in respect of expenses of the FCA to be imposed on persons that appear to the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the FCA by regulations under section 14.6Regulations under subsection (4) providing for the FCA to impose a levy must—amake provision about how the rate of the levy is to be determined;bmake provision about how the period in respect of which the levy is payable is to be determined;crequire the FCA to publish information about the rate, the period and how they are determined.7Regulations under subsection (4) may (among other things) make provision about—ainterest on any unpaid amounts payable by way of a levy;bthe recovery of such unpaid amounts.
I325I14817 The FCA and co-ordination with other regulators¶
The Treasury may by regulations amend section 98 of the Financial Services (Banking Reform) Act 2013 (payment systems: duty of the FCA and other regulators to ensure co-ordinated exercise of relevant functions) by—aamending the definition of “relevant functions” so as to add or remove a function conferred on the FCA by regulations under this Part, andbamending the definition of “objectives” so as to add or remove an objective of the FCA relevant to such a function.
1The Secretary of State or the Treasury may by regulations provide that a person listed in subsection (2) is not liable in damages for anything done or omitted to be done in the exercise of functions conferred by or under regulations made under this Part.2Those persons are—aa public authority;ba member, officer or member of staff of a public authority;ca person who could be held vicariously liable for things done or omitted to be done by a public authority.3Regulations under this section may not—amake provision removing liability for an act or omission which is shown to have been in bad faith, orbmake provision so as to prevent an award of damages made in respect of an act or omission on the ground that the act or omission was unlawful as a result of section 6(1) of the Human Rights Act 1998.
1The relevant person must, by regulations, provide for the review of provision made by the relevant person in exercise of powers to make regulations under other sections in this Part (“Part 1 provision”) (but see the exceptions in subsection (8)).2In this section, “the relevant person” means—ain relation to Part 1 provision made by the Secretary of State, the Secretary of State, andbin relation to Part 1 provision made by the Treasury, the Treasury.3Regulations under subsection (1) must require the relevant person—ato review the Part 1 provision,bto prepare and publish a report setting out the findings of each review, andcto lay a copy of the report before Parliament.4The regulations must require the relevant person—ato publish the report setting out the findings of the first review of the Part 1 provision before the end of the period of 5 years beginning with the day on which the provision comes into force, andbto publish reports setting out the findings of subsequent reviews at intervals of not more than 5 years.5The regulations must require that, in carrying out a review, the relevant person must consider whether the Part 1 provision remains appropriate, having regard to (among other things)—athe objectives it is intended to achieve, andbto the extent that it is part of data regulations, the matters to which the relevant person was required to have regard in deciding whether to make the provision (see sections 2(5) and 4(5)).6The regulations must provide that the relevant person may omit material from a report before publication if the relevant person thinks that the publication of that material might harm the commercial interests of any person.7The regulations may (whether made by the Secretary of State or the Treasury) provide for the Secretary of State and the Treasury to carry out a joint review, and to produce a joint report, in respect of Part 1 provision made by the Secretary of State and Part 1 provision made by the Treasury.8Subsection (1) does not apply in relation to—aPart 1 provision that is required to be reviewed by the relevant person by virtue of existing regulations under this section, orbPart 1 provision that makes, amends or revokes provision described in paragraph (a),nor does it require the relevant person to provide for the review of Part 1 provision that has been revoked.9Section 28 of the Small Business, Enterprise and Employment Act 2015 (duty to review regulatory provisions in secondary legislation) does not apply in relation to a power to make regulations under this Part.
I178I13820 Restrictions on processing and data protection¶
1Except as provided by subsection (2), regulations under this Part may provide for the processing of information in accordance with the regulations not to be in breach of—aany obligation of confidence owed by the person processing the information, orbany other restriction on the processing of information (however imposed).2Regulations under this Part are not to be read as authorising or requiring processing of personal data that would contravene the data protection legislation (but in determining whether particular processing of data would do so, take into account the power conferred or duty imposed by the provision of the regulations in question).3In this section—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
“personal data” has the same meaning as in that Act (see section 3(2) of that Act).
I165I6821 Regulations under this Part: supplementary¶
1Regulations under this Part may (among other things)—amake provision generally or in relation to particular cases;bmake different provision for different purposes or areas;cmake provision about the form and manner in which things must or may be done;dmake provision about the content of requests, notices or other documents;emake provision about the time by which, or period within which, things must or may be done;fmake provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;gconfer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions;hmake consequential, supplementary, incidental, transitional, transitory or saving provision.2Regulations under this Part may not require or enable a person to set the maximum amount of a fine for an offence, except that such regulations may make provision about the maximum amount referring to the standard scale, the statutory maximum or a similar amount.3Regulations under this Part may not require or enable a person to set the amount or maximum amount of, or of an increase in, a penalty or fee or to set the method for determining such an amount, except as provided by subsection (4) and sections 11(9), 15 and 16.4Regulations under this Part—amay make provision about the amount or method described in subsection (3) referring to a published index, andbmay require or enable a person to make decisions, in accordance with a maximum amount or method set out in the regulations, about the amount of, or of an increase or reduction in, a penalty or fee payable in a particular case.5Regulations under this Part making the following types of provision may amend, repeal or revoke primary legislation—aprovision about the handling of complaints;bprovision about the resolution of disputes;cprovision about appeals;dprovision described in subsection (1)(h).
I301I34122 Regulations under this Part: Parliamentary procedure and consultation¶
1The following regulations under this Part are subject to the affirmative resolution procedure—athe first regulations under each of section 2(1), (3) and (4) making provision about a particular description of customer data,bthe first regulations under each of section 4(1), (3) and (4) making provision about a particular description of business data,cregulations under section 2 or 4 which make the requirements of regulations under this Part more onerous for data holders or interface bodies,dregulations under section 6(5), 7, 8, 11, 12, 14, 16, 17 or 18, anderegulations described in section 21(5) which amend, repeal or revoke primary legislation.2Other regulations under this Part are subject to the negative resolution procedure.3Before making regulations described in subsection (1), the Secretary of State or the Treasury (as the case may be) must consult such of the following as the Secretary of State or the Treasury considers appropriate—apersons likely to be affected by the regulations or representatives of such persons;bsectoral regulators with functions in relation to data holders likely to be affected by the regulations.4The requirement in subsection (3) may be satisfied by consultation undertaken before the day on which this Act is passed.
1This section is about cases in which subordinate legislation, other than regulations under this Part, contains provision described in section 2(1) to (4) or 4(1) to (4) (and such provision is referred to in this section as “related subordinate legislation”).2The regulation-making powers under this Part may be exercised so as to make, in connection with the related subordinate legislation, any provision that they could be exercised to make as part of, or in connection with, provision made under section 2(1) to (4) or, as appropriate, section 4(1) to (4).3In this Part, references to “data regulations” include regulations made in reliance on subsection (2) to the extent that they make provision described in sections 2 to 7.4For the purposes of determining whether subordinate legislation contains provision described in sections 2(1) to (4) or 4(1) to (4), references in those sections to something specified are to be read as including something specified by or under any subordinate legislation.5In this section, “subordinate legislation” has the same meaning as in the Interpretation Act 1978 (see section 21 of that Act).
I427I22924 Repeal of provisions relating to supply of customer data¶
Omit sections 89 to 91 of the Enterprise and Regulatory Reform Act 2013 (supply of customer data).
“application programming interface” means a facility for allowing software to make use of facilities contained in other software;
“dashboard service” means an electronic communications service by means of which information may be requested by and provided to a person;
“digital content” means data which is produced and supplied in digital form;
“electronic communications service” has the meaning given by section 32 of the Communications Act 2003;
“goods” includes water, gas and electricity (however supplied);
“micro business” has the meaning given by section 33 of the Small Business, Enterprise and Employment Act 2015, read with any regulations under that section;
“primary legislation” means—
an Act of Parliament;
an Act of the Scottish Parliament;
a Measure or Act of Senedd Cymru;
Northern Ireland legislation;
“processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act) and related terms are to be interpreted accordingly;
“public authority” means a person whose functions—
are of a public nature, or
include functions of that nature;
“small business” has the meaning given by section 33 of the Small Business, Enterprise and Employment Act 2015, read with any regulations under that section;
“specified” means specified, or of a description specified, by regulations under this Part, or in exercise of a power conferred by such regulations, except to the extent otherwise provided in this Part;
“third party recipient” means—
in section 3, a third party in relation to customer data (see section 2(2)),
in sections 4 and 5, a third party recipient in relation to business data (see section 4(2)), and
in other sections, a third party recipient in relation to customer data or business data (see sections 2(2) and 4(2)).
2In this Part, references to doing something “in the course of a business” include doing something in the course of—aa trade, craft or profession, orbany other undertaking carried on for gain or reward.3In this Part—areferences to making arrangements include producing model arrangements,breferences to managing a facility (or an interface that is a facility) include operating, or overseeing the operation, of a facility,creferences to managing a service (or an interface that is a service) include providing, or overseeing the provision of, a service, anddreferences to managing standards or arrangements include assisting people to use them or overseeing how they are used.4In this Part, references to regulations made under subsection (3) of section 4 or any of sections 5 to 21 (and references which include such regulations) include regulations made under section 4(4)(c) or (d) which make provision that could be made under the other subsection or section.
1This Part contains provision to secure the reliability of digital verification services by means of—aa trust framework (see section 28),bsupplementary codes (see section 29),ca register (see section 32),dan information gateway (see section 45), andea trust mark (see section 50).2In this Part, “digital verification services” means verification services provided to any extent by means of the internet.3In subsection (2), “verification services” means services that are provided at the request of an individual and consist in—aascertaining or verifying a fact about the individual from information provided otherwise than by the individual, andbconfirming to another person that the fact about the individual has been ascertained or verified from information so provided.
1The Secretary of State must prepare and publish a document (“the DVS trust framework”) setting out rules concerning the provision of digital verification services.2Those rules may include (among other things) rules relating to, and to the conduct of, a person who provides such services; and references in this Part to a person providing services in accordance with the DVS trust framework (however expressed) include a person complying with such rules.3In preparing the DVS trust framework, the Secretary of State must consult—athe Information Commissioner, andbsuch other persons as the Secretary of State considers appropriate.4The requirement in subsection (3) may be satisfied by consultation undertaken before the coming into force of this section.5The Secretary of State may revise and republish the DVS trust framework (whether following a review under section 31 or otherwise).6The DVS trust framework, and any revised version of the framework, must specify the time it comes into force (which must not be a time earlier than the time it is published).7The DVS trust framework, and any revised version of the framework, may—aset out different rules for different digital verification services,bspecify that provisions come into force at different times for different purposes, andcmake transitional or saving provision.8Where the Secretary of State revises and republishes the DVS trust framework, the DVS trust framework (as revised) may provide that from a date, or from the end of a period, specified in the framework a pre-revision certificate is required to be ignored for the purposes of sections 33(1)(a), 35(1)(c), 40(1)(c) and 42(1)(c).9In subsection (8), a “pre-revision certificate” means a certificate which—acertifies that digital verification services provided by the holder of the certificate are provided in accordance with the DVS trust framework, andbwas issued before the time the relevant revision to the DVS trust framework comes into force.10Provision included in the DVS trust framework in reliance on subsection (8) may make different provision in relation to different descriptions of pre-revision certificate.
1The Secretary of State may prepare and publish one or more sets of rules concerning the provision of digital verification services which supplement the DVS trust framework.2In this Part, a set of rules published under subsection (1) is referred to as a supplementary code.3Those rules may include (among other things) rules relating to, and to the conduct of, a person who provides such services; and in this Part references to a person providing services in accordance with a supplementary code (however expressed) include a person complying with such rules.4In preparing a set of rules, the Secretary of State must consult—athe Information Commissioner, andbsuch other persons as the Secretary of State considers appropriate.5The requirement in subsection (4) may be satisfied by consultation undertaken before the coming into force of this section.6The Secretary of State may revise and republish a supplementary code (whether following a review under section 31 or otherwise).7A supplementary code, and any revised version of a supplementary code, must specify the time it comes into force (which must not be a time earlier than the time it is published).8A supplementary code, and any revised version of a supplementary code, may—aset out different rules for different digital verification services,bspecify that provisions come into force at different times for different purposes, andcmake transitional or saving provision.9Where the Secretary of State revises and republishes a supplementary code, the supplementary code (as revised) may provide that from a date, or from the end of a period, specified in the code a pre-revision certificate is required to be ignored for the purposes of sections 36(1)(a), 37(1)(c), 43(1)(c)and 44(1)(c).10In subsection (9), a “pre-revision certificate” means a certificate which—acertifies that digital verification services provided by the holder of the certificate are provided in accordance with the supplementary code, andbwas issued before the time the relevant revision to the supplementary code comes into force.11Provision included in a supplementary code in reliance on subsection (9) may make different provision in relation to different descriptions of pre-revision certificate.
1The Secretary of State may determine to withdraw a supplementary code.2A determination must—abe published, andbspecify when the code is withdrawn, which must be a time after the end of the period of 21 days beginning with the day on which the determination is published.
I200I20831 Review of DVS trust framework and supplementary codes¶
1At least every 12 months, the Secretary of State must—acarry out a review of the DVS trust framework, andbat the same time, carry out a review of each supplementary code which has not been withdrawn.2In carrying out a review under subsection (1), the Secretary of State must consult—athe Information Commissioner, andbsuch other persons as the Secretary of State considers appropriate.
1The Secretary of State must establish and maintain a register of persons providing digital verification services.2The register is referred to in this Part as the DVS register.3The Secretary of State must make the DVS register publicly available.
1The Secretary of State must register a person providing digital verification services in the DVS register if—athe person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with the DVS trust framework,bthe person applies to be registered in the DVS register in respect of one or more of the digital verification services to which the certificate relates,cthe application complies with any requirements imposed by a determination under section 38, anddthe person complies with any regulations under section 39(1) requiring a fee to be paid.2But subsection (1) is subject to—athe power to refuse registration under section 34(1), andbthe duties to refuse registration under sections 34(10) and 41(10).3If the conditions in paragraphs (a) to (d) of subsection (1) are not met, the Secretary of State may not register a person in the DVS register.4The register must record the digital verification services in respect of which a person is, from time to time, registered.5For the purposes of subsection (1)(a), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).6In this Part, “accredited conformity assessment body” means a conformity assessment body that is accredited by the UK national accreditation body in accordance with Article 5 of the Accreditation Regulation as competent to carry out assessments of whether digital verification services are provided in accordance with the DVS trust framework.7In subsection (6)—
“the Accreditation Regulation” means Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93;
“conformity assessment body” has the same meaning as in the Accreditation Regulation (see Article 2(13) of that Regulation);
“the UK national accreditation body” means the UK national accreditation body for the purposes of Article 4(1) of the Accreditation Regulation.
I307I15234 Power to refuse registration in the DVS register¶
1The Secretary of State may refuse to register a person providing digital verification services in the DVS register if the Secretary of State—aconsiders that it is necessary to do so in the interests of national security, orbis satisfied that the person is failing to comply with the DVS trust framework in respect of one or more of the digital verification services in respect of which the person applies to be registered.2Before refusing to register a person under this section the Secretary of State must, by written notice, inform the person that the Secretary of State intends to do so.3The notice must—astate the name and address of the person,bstate the reason why the Secretary of State—iconsiders that it is necessary to refuse to register the person in the interests of national security, oriiis satisfied that the person is failing as mentioned in subsection (1)(b),cstate whether the Secretary of State intends to specify a period in the notice under subsection (8) and, if so, what period is intended to be specified,dstate that the person may make written representations to the Secretary of State about—ithe Secretary of State’s intention to refuse to register the person in the DVS register, andiiwhere relevant, the period the Secretary of State intends to specify in the notice under subsection (8), andespecify the period within which such representations may be made.4Where the Secretary of State intends to refuse to register a person in reliance on subsection (1)(a), the requirement in subsection (3)(b) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection (3)(b)(i) would be contrary to the interests of national security.5The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.6If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection (3)(d), the notice must also—astate that the person may make such representations, andbspecify the arrangements for making such representations and the time at which, or the period within which, they may be made.7When deciding whether to refuse to register the person in the DVS register under this section, the Secretary of State must consider any oral or written representations made by the person in accordance with the notice.8Where the Secretary of State refuses to register the person in the DVS register under this section, the Secretary of State must by written notice inform the person that the person’s application for registration has been refused.9The Secretary of State may, in the notice given under subsection (8), state that any further application for registration made by the person during a period specified in the notice will be refused.10If the person applies to be registered in the DVS register during the period specified in the notice in reliance on subsection (9), the Secretary of State must refuse the application.11The period specified in the notice in reliance on subsection (9) must begin with the day on which the notice is given and must not exceed two years.
1Subsection (2) applies if—aa person is registered in the DVS register,bthe person applies for their entry in the register to be amended to record additional digital verification services that the person provides in accordance with the DVS trust framework,cthe person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with the DVS trust framework,dthe application complies with any requirements imposed by a determination under section 38, andethe person complies with any regulations under section 39(1) requiring a fee to be paid.2The Secretary of State must amend the DVS register to record that the person is also registered in respect of the additional services referred to in subsection (1).3If the conditions in paragraphs (a) to (e) of subsection (1) are not met, the Secretary of State may not amend the DVS register as described in subsection (2).4For the purposes of subsection (1)(c), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
1Subsection (2) applies if—aa person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with a supplementary code,bthe person applies for a note about one or more of the services to which the certificate relates to be included in the entry relating to that person in the DVS register,cthe application complies with any requirements imposed by a determination under section 38, anddthe person complies with any regulations under section 39(1) requiring a fee to be paid.2The Secretary of State must include a note in the entry relating to the person in the DVS register recording that the person provides, in accordance with the supplementary code referred to in subsection (1), the services in respect of which the person made the application referred to in that subsection.3But subsection (2) does not apply if the supplementary code referred to in subsection (1) has been withdrawn.4If the conditions in paragraphs (a) to (d) of subsection (1) are not met, the Secretary of State may not include a note described in subsection (2) in the DVS register.5For the purposes of subsection (1)(a), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).6In this Part, a note included in the DVS register in accordance with subsection (2) is referred to as a supplementary note.
I422I36737 Addition of services to supplementary notes¶
1Subsection (2) applies if—aa person has a supplementary note included in the DVS register relating to a supplementary code,bthe person applies for the note to be amended to record additional digital verification services that the person provides in accordance with that code,cthe person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with that code,dthe application complies with any requirements imposed by a determination under section 38, andethe person complies with any regulations under section 39(1) requiring a fee to be paid.2The Secretary of State must amend the note to record that the person also provides the additional services referred to in subsection (1) in accordance with the supplementary code to which the note relates.3But subsection (2) does not apply if the supplementary code to which the note relates has been withdrawn.4If the conditions in paragraphs (a) to (e) of subsection (1) are not met, the Secretary of State may not amend the note as described in subsection (2).5For the purposes of subsection (1)(c), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
I336I8038 Applications for registration, supplementary notes, etc¶
1The Secretary of State may determine—athe form of an application under section 33, 35, 36 or 37,bthe information to be contained in or provided with the application,cthe documents to be provided with the application, anddthe manner in which the application is to be submitted.2A determination may make different provision for different purposes.3The Secretary of State must publish a determination.4The Secretary of State may revise a determination.5If the Secretary of State revises a determination the Secretary of State must publish the determination as revised.
I84I7139 Fees for applications for registration, supplementary notes, etc¶
1The Secretary of State may by regulations make provision for or in connection with—athe payment of fees for applications under sections 33, 35, 36 and 37, andbthe payment of fees in connection with continued registration in the DVS register.2The regulations may not provide for payment of fees to anyone other than the Secretary of State.3The regulations must—aspecify the amount, or the maximum amount of a fee, orbprovide for a fee, or the maximum amount of a fee, to be determined in accordance with regulations.4The regulations may provide for the amount of a fee to exceed the administrative costs of determining the application or the administrative costs associated with the continued registration (as the case may be).5Regulations under subsection (1) may (among other things) make provision about the following—awhen fees are to be paid;bthe manner in which fees are to be paid;cthe payment of discounted fees;dexceptions to requirements to pay fees;ethe refund of fees (in whole or in part);finterest on any unpaid amounts,including provision conferring functions on the Secretary of State in relation to the matters in paragraphs (a) to (e).6A fee payable under regulations made under subsection (1)(b), and any interest payable in respect of it, is recoverable summarily (or, in Scotland, recoverable) as a civil debt.7The regulations may—amake different provision for different purposes;bmake transitional, transitory or saving provision.8Regulations under this section are subject to the negative resolution procedure.
I118I11240 Duty to remove person from the DVS register¶
1The Secretary of State must remove a person from the DVS register if the person—aasks to be removed from the register,bceases to provide all of the digital verification services in respect of which the person is registered in the register, orcno longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the DVS trust framework.2For the purposes of subsection (1)(c), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
I184I8141 Power to remove person from the DVS register¶
1The Secretary of State may remove a person from the DVS register if—athe Secretary of State is satisfied that the person is failing to comply with the DVS trust framework when providing one or more of the digital verification services in respect of which the person is registered,bthe person has a supplementary note included in the DVS register and the Secretary of State is satisfied that the person is failing to comply with the supplementary code to which the note relates when providing one or more of the digital verification services recorded in the note,cthe Secretary of State is satisfied that the person has failed to provide the Secretary of State with information in accordance with a notice under section 51, ordthe Secretary of State considers that it is necessary to do so in the interests of national security.2Before removing a person from the DVS register under this section the Secretary of State must, by written notice, inform the person that the Secretary of State intends to do so.3The notice must—astate the name and address of the person,bstate the reason why the Secretary of State—iis satisfied that the person is failing or has failed as mentioned in subsection (1)(a) to (c), oriiconsiders that it is necessary to remove the person from the DVS register in the interests of national security,cstate whether the Secretary of State intends to specify a period in the notice under subsection (8) and, if so, what period is intended to be specified,dstate that the person may make written representations to the Secretary of State about—ithe Secretary of State’s intention to remove the person from the DVS register, andiiwhere relevant, the period the Secretary of State intends to specify in the notice under subsection (8), andespecify the period within which such representations may be made.4The requirement in subsection (3)(b) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection (3)(b)(ii) would be contrary to the interests of national security.5The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.6If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection (3)(d), the notice must also—astate that the person may make such representations, andbspecify the arrangements for making such representations and the time at which, or the period within which, they may be made.7When deciding whether to remove the person from the DVS register under this section, the Secretary of State must consider any oral or written representations made by the person in accordance with the notice.8Where the Secretary of State removes the person from the DVS register under this section, the Secretary of State must by written notice inform the person of that.9The Secretary of State may, in the notice given under subsection (8), state that any application for re-registration made by the person during a period specified in the notice will be refused.10If the person applies to be re-registered during the period specified in the notice in reliance on subsection (9), the Secretary of State must refuse the application.11The period specified in the notice in reliance on subsection (9) must begin with the day on which the notice is given and must not exceed two years.
I375I31442 Duty to remove services from the DVS register¶
1Where a person is registered in the DVS register in respect of digital verification services, subsection (2) applies if the person—aasks for the register to be amended so that the person is no longer registered in respect of one or more of those services,bceases to provide one or more of those services (but not all of them), orcno longer holds a certificate from an accredited conformity assessment body certifying that all of those services are provided in accordance with the DVS trust framework.2The Secretary of State must amend the register to record that the person is no longer registered in respect of (as the case may be)—athe service or services mentioned in a request described in subsection (1)(a),bthe service or services which the person has ceased to provide, orcthe service or services for which there is no longer a certificate as described in subsection (1)(c).3For the purposes of subsection (1)(c), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
I397I29443 Duty to remove supplementary notes from the DVS register¶
1The Secretary of State must remove a supplementary note included in the entry in the DVS register relating to a person if—athe person asks for the note to be removed,bthe person ceases to provide all of the digital verification services to which the note relates,cthe person no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the supplementary code to which the note relates, ordthe supplementary code to which the note relates has been withdrawn.2For the purposes of subsection (1)(c), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
I289I37244 Duty to remove services from supplementary notes¶
1Where a person has a supplementary note included in their entry in the DVS register in respect of digital verification services, subsection (2) applies if the person—aasks for the note to be amended so that it no longer records one or more of those services,bceases to provide one or more of the services recorded in the note (but not all of them), orcno longer holds a certificate from an accredited conformity assessment body certifying that all of the services included in the note are provided in accordance with a supplementary code.2The Secretary of State must amend the supplementary note so it no longer records (as the case may be)—athe service or services mentioned in a request described in subsection (1)(a),bthe service or services which the person has ceased to provide, orcthe service or services for which there is no longer a certificate as described in subsection (1)(c).3For the purposes of subsection (1)(c), a certificate is to be ignored if—ait has expired in accordance with its terms,bit has been withdrawn by the body that issued it, orcit is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
I34645 Power of public authority to disclose information to registered person¶
1This section applies where—aa person is registered in the DVS register, andban individual makes a request to the person for the provision of digital verification services in respect of which the person is registered.2A public authority may disclose to the person information relating to the individual for the purpose of enabling the person to provide the digital verification services for the individual.3A disclosure of information under this section does not breach—aany obligation of confidence owed by the public authority making the disclosure, orbany other restriction on the disclosure of information (however imposed).4But this section does not authorise a disclosure of information which—awould contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by this section is to be taken into account), orbis prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.5This section does not authorise a public authority to disclose information obtained by the authority otherwise than in connection with the exercise by the authority of functions of a public nature.6This section does not affect a power to disclose information that exists apart from this section.7A public authority may charge a person fees in respect of the disclosure to the person of information under this section.8In this section—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
“public authority” means a person whose functions—
are of a public nature, or
include functions of that nature.
I6146 Information disclosed by the Revenue and Customs¶
1This section applies where the Revenue and Customs disclose personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.2The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Commissioners for His Majesty’s Revenue and Customs.3Any other person who receives the information, whether directly or indirectly from the person to whom the Revenue and Customs disclose the information, must not further disclose the information, except with the consent of the Commissioners for His Majesty’s Revenue and Customs.4If a person discloses information in contravention of this section, section 19 of the Commissioners for Revenue and Customs Act 2005 (offence of wrongful disclosure) applies in relation to that disclosure as it applies in relation to a disclosure of information in contravention of section 20(9) of that Act.5In this section—
“personal information” means information relating to a person whose identity—
is specified in the information, or
can be deduced from it;
“the Revenue and Customs” has the meaning given by section 17(3) of the Commissioners for Revenue and Customs Act 2005.
I22447 Information disclosed by the Welsh Revenue Authority¶
1This section applies where the Welsh Revenue Authority discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.2The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Welsh Revenue Authority.3Any other person who receives the information, whether directly or indirectly from the person to whom the Welsh Revenue Authority discloses the information, must not further disclose the information, except with the consent of the Welsh Revenue Authority.4A person who discloses information in contravention of subsection (2) or (3) commits an offence.5It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—athat the disclosure was lawful, orbthat the information had already lawfully been made available to the public.6A person who commits an offence under subsection (4) is liable—aon summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);bon summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);con summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);don conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).7In this section, “personal information” means information relating to a person whose identity—ais specified in the information, orbcan be deduced from it.
1This section applies where Revenue Scotland discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.2The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of Revenue Scotland.3Any other person who receives the information, whether directly or indirectly from the person to whom Revenue Scotland discloses the information, must not further disclose the information, except with the consent of Revenue Scotland.4A person who discloses information in contravention of subsection (2) or (3) commits an offence.5It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—athat the disclosure was lawful, orbthat the information had already lawfully been made available to the public.6A person who commits an offence under subsection (4) is liable—aon summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);bon summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);con summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);don conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).7In this section, “personal information” means information relating to a person whose identity—ais specified in the information, orbcan be deduced from it.
I105I35549 Code of practice about the disclosure of information¶
1The Secretary of State must prepare and publish a code of practice about the disclosure of information under section 45.2The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).3A public authority must have regard to the code of practice in disclosing information under section 45.4The Secretary of State may from time to time revise and republish the code of practice.5In preparing or revising the code of practice, the Secretary of State must consult—athe Information Commissioner,bthe Welsh Ministers,cthe Scottish Ministers,dthe Department of Finance in Northern Ireland, andesuch other persons as the Secretary of State considers appropriate.6The requirement in subsection (5) may be satisfied by consultation undertaken before the coming into force of this section.7The Secretary of State may not publish the first version of the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.8The Secretary of State may not republish the code of practice following its revision unless—aa draft of the code as revised has been laid before each House of Parliament, andbthe 40-day period has expired without either House of Parliament resolving not to approve the draft.9“The 40-day period” means—athe period of 40 days beginning with the day on which the draft is laid before Parliament, orbif the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.10In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.11In this section, “public authority” means a person whose functions—aare of a public nature, orbinclude functions of that nature.
I145I30250 Trust mark for use by registered persons¶
1The Secretary of State may designate a mark for use in the course of providing, or offering to provide, digital verification services.2A mark designated under this section must be published by the Secretary of State.3A mark designated under this section may not be used by a person in the course of providing, or offering to provide, digital verification services unless the person is registered in the DVS register in respect of those digital verification services.4The Secretary of State may enforce subsection (3) in civil proceedings for an injunction or, in Scotland, an interdict.
I77I10651 Power of Secretary of State to require information¶
1The Secretary of State may by written notice require—aan accredited conformity assessment body, orba person registered in the DVS register,to provide the Secretary of State with information that the Secretary of State reasonably requires for the purposes of the exercise of the Secretary of State’s functions under this Part.2A notice under this section must state why the information is required for the purposes of the exercise of those functions.3A notice under this section—amay specify or describe particular information or a category of information;bmay specify the form in which the information must be provided;cmay specify the time at which, or the period within which, the information must be provided;dmay specify the place where the information must be provided.4A notice under this section that is given to a person registered in the DVS register must provide information about the consequences under section 41 of failure to comply with the notice.5The Secretary of State may cancel a notice under this section by notice to the person to whom it was given.6A disclosure of information required by a notice under this section does not breach—aany obligation of confidence owed by the person making the disclosure, orbany other restriction on the disclosure of information (however imposed).7But a notice under this section does not require a disclosure of information if the disclosure—awould contravene section 46, 47 or 48,bwould contravene the data protection legislation (but in determining whether a disclosure would do so, the duty imposed by the notice is to be taken into account), orcis prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.8A notice under this section does not require a person to provide the Secretary of State with information in respect of a communication which is made—abetween a professional legal adviser and the adviser’s client, andbin connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under this Part.9In subsection (8), references to the client of a professional legal adviser include references to a person acting on behalf of the client.10A notice under this section does not require a person to provide the Secretary of State with information if doing so would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.11The reference to an offence in subsection (10) does not include an offence under—asection 5 of the Perjury Act 1911 (false statements made otherwise than on oath);bsection 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);cArticle 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).12In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act).
I188I40952 Arrangements for third party to exercise functions¶
1The Secretary of State may make arrangements for a person prescribed by regulations under this section to exercise a relevant function of the Secretary of State (and, where arrangements are made, references in this Part, or in regulations made under this Part, to the Secretary of State are to be read accordingly).2Arrangements under this section may—aprovide for the Secretary of State to make payments to the person, andbmake provision as to the circumstances in which any such payments are to be repaid to the Secretary of State.3Regulations under this section are subject to the affirmative resolution procedure.4In this section, “relevant function” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 39) other than a power to make regulations.5If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise.
1The Secretary of State must prepare and publish reports on the operation of this Part.2The first report must be published within the period of 12 months beginning with the day on which section 28 comes into force.3The reports must be published not more than 12 months apart.
The Table below lists provisions that define or otherwise explain terms defined for the purposes of this Part.
Term
Provision
accredited conformity assessment body
section
33
(6)
digital verification services
section
27
(2)
the DVS register
section
32
(2)
the DVS trust framework
section
28
(1)
supplementary code
section
29
(2)
supplementary note
section
36
(6)
I173I4155 Powers relating to verification of identity or status¶
1In section 15 of the Immigration, Asylum and Nationality Act 2006 (penalty for employing a person subject to immigration control), after subsection (7) insert—2In section 34 of the Immigration Act 2014 (requirements which may be prescribed for the purposes of provisions about occupying premises under a residential tenancy agreement)—ain subsection (1)—iin paragraph (a), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”,iiin paragraph (b), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”, andiiiin paragraph (c), at the end insert “, including steps involving the use of services provided by a DVS-registered person or a DVS-registered person of a prescribed description”, andbafter that subsection insert—3In Schedule 6 to the Immigration Act 2016 (illegal working compliance orders etc), after paragraph 5 insert—
I31256 National Underground Asset Register: England and Wales¶
1After section 106 of the New Roads and Street Works Act 1991 insert—2Section 166 of the New Roads and Street Works Act 1991, so far as relating to Part 3A of that Act (inserted by subsection (1)), extends to England and Wales.3In section 167 of that Act (Crown application), after subsection (5) insert—4Schedule 1 to this Act inserts Schedule 5A into the New Roads and Street Works Act 1991 (monetary penalties).
I5357 Information in relation to apparatus: England and Wales¶
1The New Roads and Street Works Act 1991 is amended in accordance with subsections (2) to (6).2For the italic heading before section 79 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.3In section 79—afor the heading substitute “Information in relation to apparatus”;bin subsection (1), for paragraph (c) substitute—
;
cafter subsection (1A) (as inserted by section 46(2) of the Traffic Management Act 2004) insert—
;
domit subsection (3);ein subsection (3A) (as inserted by section 46(4) of the Traffic Management Act 2004)—ifor “to (3)” substitute “and (2A)”;iifor “subsection (1)” substitute “this section”;fafter subsection (3A) insert—
;
gin subsection (4)(a), omit “not exceeding level 5 on the standard scale”;hafter subsection (6) insert—4For section 80 (duty to inform undertakers of location of apparatus) substitute—5Before section 81 (duty to maintain apparatus) insert—
.
6In section 104 (regulations)—ain subsection (1)—iafter “Part” insert “, except in section 79,”;iiomit from “, which” to the end;bafter subsection (1) insert—
;
cin subsection (2), after “Regulations” insert “made by the Secretary of State”;dafter subsection (2) insert—7In consequence of the provision made by subsection (4), omit section 47 of the Traffic Management Act 2004.8In Schedule 7B to the Government of Wales Act 2006 (general restriction on competence of Senedd Cymru), in paragraph 11(6)(b) (exceptions to restrictions relating to Ministers of the Crown), before sub-paragraph (i) insert—
.
I10458 National Underground Asset Register: Northern Ireland¶
1The Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) is amended in accordance with subsections (2) to (4).2In Article 2 (interpretation), in paragraph (2)—aafter the definition of “in” insert—
;
bin the definition of “prescribed”—ifor “means” substitute “means—”;iithe words from “prescribed by” to the end become paragraph (a);iiiat the beginning of that paragraph insert “except in Articles 39 and 40 and a NUAR provision,”;ivafter that paragraph insert—
bin paragraph (1), after “Order” insert “, other than regulations made by the Secretary of State,”;cbefore paragraph (2) insert—5Article 59(A2) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (inserted by subsection (4)(a)) is revoked on the coming into operation of Article 59(1A) of that Order (as inserted by Article 28(3) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1))).6Schedule 2 to this Act inserts Schedule 2ZA into the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (monetary penalties).
I19459 Information in relation to apparatus: Northern Ireland¶
1The Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) is amended in accordance with subsections (2) to (5).2For the italic heading before Article 39 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.3In Article 39—afor the heading substitute “Information in relation to apparatus”;bin paragraph (1), for sub-paragraph (c) substitute—
;
cafter paragraph (1A) (as inserted by Article 22(2) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1))) insert—
;
domit paragraph (3);ein paragraph (3A) (as inserted by Article 22(4) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1)))—ifor “to (3)” substitute “and (2A)”;iifor “paragraph (1)” substitute “this Article”;fafter paragraph (3A) insert—
;
gafter paragraph (5) insert—4For Article 40 (duty to inform undertakers of location of apparatus) substitute—5Before Article 41 (duty to maintain apparatus) insert—
.
6As a consequence of the provision made by subsection (4), omit Article 23 of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1)).7A power of the Secretary of State to make regulations under paragraph (1) or (2) of Article 39 of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (by virtue of subsection (3)(g)) includes power to amend or revoke any provision of the Street Works (Records) Regulations (Northern Ireland) 2004 (S.R. (N.I.) 2004 No. 276) made under the paragraph concerned.
1A requirement to consult under a provision inserted into the New Roads and Street Works Act 1991 by section 56 or 57 may be satisfied by consultation undertaken before the day on which this Act is passed.2A requirement to consult under a provision inserted into the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) by section 58 or 59 may be satisfied by consultation undertaken before the day on which this Act is passed.
I37961 Form in which registers of births and deaths are to be kept¶
1The Births and Deaths Registration Act 1953 is amended as follows.2For section 25 (provision of registers, etc, by Registrar General) substitute—3Omit the following provisions—asection 26 (quarterly returns to be made by registrar to superintendent registrar);bsection 27 (quarterly returns by superintendent registrar to Registrar General);csection 28 (custody of registers, etc).
I2962 Provision of equipment and facilities by local authorities¶
In the Registration Service Act 1953, after section 11 insert—
1The Births and Deaths Registration Act 1953 is amended as follows.2After section 38A insert—3In section 39A (regulations made by the Minister: further provisions), after subsection (5) insert—
1The repeal of section 28 of the Births and Deaths Registration Act 1953 by section 61 above does not affect—athe requirement under section 28(2) of that Act for every superintendent registrar (“S”) to keep with the records of S’s office any registers of live-births or of deaths which are in S’s custody immediately before the coming into force of that repeal, orbthe requirement under section 28(4) of that Act for the Registrar General to keep in the General Register Office—iany certified copies or information sent or provided under section 27 of that Act (quarterly returns by superintendent registrar to Registrar General), oriiany registers of still-births that were forwarded to the Registrar General before the coming into force of that repeal.2Any register of live-births or of deaths which, immediately before the coming into force of this section, is in the custody of a registrar and is unfilled is, as soon as is reasonably practicable after the coming into force of this section, to be delivered to the superintendent registrar (“S”) to be kept by S with the records of S’s office.3Any register of still-births which, immediately before the coming into force of this section, is in the custody of a registrar and is unfilled is, as soon as is reasonably practicable after the coming into force of this section, to be forwarded to the Registrar General to be kept in the General Register Office in such order and manner as the Registrar General thinks fit.4The Registrar General may dispose of—aany certified copies held by the Registrar General of entries in any register of still-births forwarded to the Registrar General under section 28(3) of the Births and Deaths Registration Act 1953 or subsection (3) above, orbany information contained in those entries which is held by the Registrar General in electronic form by virtue of section 27 of that Act.5Where, at any time during the period mentioned in subsection (6), a copy has been kept otherwise than in hard copy form of any register of births or register of deaths kept for a sub-district under the Births and Deaths Registration Act 1953—athat copy is to be treated, on and after the day on which section 61 of this Act comes into force, as the register kept for the sub-district for the purposes of that Act,bon and after that day, the register is to be treated for the purposes of section 25(3) of that Act as having been kept in the form in which the copy was kept,cwhere before that day a person signed any entry in the register, the entry is to continue, on and after that day, to be regarded for the purposes of that Act as having been signed by the person, anddthe Registrar General may dispose of—iany certified copies held by the Registrar General of entries in the register, oriiany information contained in those entries which is held by the Registrar General in electronic form by virtue of section 27 of that Act.6The period referred to in subsection (5) is the period—abeginning with 1 July 2009, andbending immediately before the day on which section 61 comes into force.7Expressions used in this section and in the Births and Deaths Registration Act 1953 have the same meaning in this section as in that Act.
“the 2018 Act” means the Data Protection Act 2018;
“the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
I126I42867 Meaning of research and statistical purposes¶
1In Article 4 of the UK GDPR (definitions)—athe existing text becomes paragraph 1, andbafter that paragraph insert—2In consequence of the amendment made by subsection (1)(a), in section 6 of the 2018 Act (meaning of “controller”), for “4(7)” substitute “4(1)(7)”.
I206I42968 Consent to processing for the purposes of scientific research¶
1Article 4 of the UK GDPR (definitions) is amended as follows.2In point (11) of paragraph 1 (definition of “consent”), at the end insert “(and see paragraphs 6 and 7 of this Article)”.3After paragraph 5 (inserted by section 67 of this Act) insert—
1The 2018 Act is amended as follows.2In section 33 (definitions), after subsection (1) insert—3In section 34(2) (overview of Chapter 2 of Part 3), after paragraph (a) (but before the “and” at the end of that paragraph) insert—
.
4After section 40 insert—5In section 206 (index of defined expressions), in the Table, in the entry for “consent”—aafter “consent” insert “(to processing of personal data)”,bfor “Part” substitute “Parts 3 and”, andcfor “section” substitute “sections 33, 40A and”.
1The UK GDPR is amended in accordance with subsections (2) to (5).2In Article 6(1) (lawful processing)—ain point (e)—iafter “task” insert “of the controller”, andiiafter “or” insert “a task carried out”,bafter that point insert—
, and
cin the words after point (f), for “Point (f)” substitute “Points (ea) and (f)”.3In Article 6(3) (basis for processing etc), in the last subparagraph, in the first sentence—aafter “task” insert “of the controller”, andbafter “interest or” insert “a task carried out”.4In Article 6, at the end insert—5In Article 21(1) (right to object), after “point (e)” insert “, (ea)”.6Schedule 4 to this Act inserts Annex 1 to the UK GDPR.7In section 8 of the 2018 Act (lawfulness of processing: public interest etc), omit “the controller’s”.8In the provisions listed in subsection (9)—afor “gateway” substitute “gateways”, andbfor “were omitted” substitute “disapplied only the gateway in point (ea) (recognised legitimate interests)”.9The provisions are—asection 40(8) of the Freedom of Information Act 2000 (personal data which is exempt information);bsection 38(5A) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);cregulation 13(6) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);dregulation 11(7) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);eregulation 45(1E) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);fregulation 39(1E) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information);gregulation 9(9) of the INSPIRE Regulations 2009 (S.I. 2009/3157) (limitation of public access to personal data included in a spatial data set);hregulation 10(8) of the INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440) (limitation of public access to personal data included in a spatial data set).
1The UK GDPR is amended in accordance with subsections (2) to (5).2In Article 5(1)(b) (purpose limitation)—aafter “collected” insert “(whether from the data subject or otherwise)”,bafter “further processed” insert “by or on behalf of a controller”, andcfor the words from “those purposes;” to “initial purposes” substitute “the purposes for which the controller collected the data”.3In Article 5, at the end insert—4In Article 6 (lawfulness of processing), omit paragraph 4.5After Article 8 insert—6Schedule 5 to this Act inserts Annex 2 to the UK GDPR.7The 2018 Act is amended in accordance with subsections (8) to (10).8In section 36(1) (the second data protection principle)—ain paragraph (a), for “on any occasion” substitute “(whether from the data subject or otherwise)”, andbin paragraph (b)—iafter “processed” insert “by or on behalf of a controller”, andiifor “it was collected” substitute “the controller collected it”.9In section 87(1) (the second data protection principle)—ain paragraph (a), for “on any occasion” substitute “(whether from the data subject or otherwise)”, andbin paragraph (b)—iafter “processed” insert “by or on behalf of a controller”, andiifor “it was collected” substitute “the controller collected it”.10In paragraph 1 of Schedule 2 (exemptions etc from the UK GDPR: provisions to be adapted or restricted), omit sub-paragraph (b)(ii).
I37772 Processing in reliance on relevant international law¶
I1311The UK GDPR is amended in accordance with subsections (2) to (5).I1312In Article 6(3) (lawfulness of processing: basis in domestic law)—ain the first subparagraph, omit “and (e)”,bafter that subparagraph insert—
, and
cin the last subparagraph, in the last sentence, after “domestic law” insert “or relevant international law”.I4323In Article 8A(3)(e) (purpose limitation: further processing necessary to safeguard an objective listed in Article 23(1)) (inserted by section 71 of this Act), at the end insert “or by relevant international law (see section 9A of the 2018 Act)”.I1314In Article 9 (processing of special categories of personal data)—ain paragraph 2(g) (substantial public interest), after “domestic law” insert “, or relevant international law,”, andbin paragraph 5, before point (a) insert—
.
I1315In Article 10 (processing of personal data relating to criminal convictions and offences)—ain paragraph 1, after “domestic law” insert “, or relevant international law,”, andbin paragraph 2, before point (a) insert—
.
I1316The 2018 Act is amended in accordance with subsections (7) and (8).I120I4327Before section 10 (and the italic heading before that section) insert—I1318Before Schedule 1 insert—
Processing of special categories of personal data¶
I45I47073 Elected representatives responding to requests¶
In paragraph 23 of Schedule 1 to the 2018 Act (processing of special categories of personal data: elected representatives responding to requests), in sub-paragraph (4), for “fourth day after” substitute “period of 30 days beginning with the day after”.
I331I15574 Processing of special categories of personal data¶
1In Chapter 2 of the UK GDPR, after Article 11 insert—2The 2018 Act is amended in accordance with subsections (3) to (9).3In section 33 (definitions of expressions used in Part 3), after subsection (6) insert—4In section 35 (the first data protection principle)—ain subsection (6)(b) (power to omit conditions added to Schedule 8 by regulations), after “by”, in the first place it occurs, insert “varying or”, andbin subsection (8) (definition of “sensitive processing”), for “section” substitute “Part”.5After section 42 insert—6In section 84 (definitions of expressions used in Part 4), after subsection (6) insert—7In section 86 (the first data protection principle)—ain subsection (3)(b) (power to omit conditions added to Schedule 10 by regulations), after “by”, in the first place it occurs, insert “varying or”, andbin subsection (7) (definition of “sensitive processing”), for “section” substitute “Part”.8After section 91 insert—9In section 206 (index of defined expressions), in the Table, at the appropriate place insert—
“sensitive processing (in Parts 3 and 4)
sections 35 and 86”.
10The Investigatory Powers Act 2016 is amended in accordance with subsections (11) to (13).11In section 202(4) (restrictions on use of class BPD warrants: definitions), omit the definition of “sensitive personal data” and insert—12After that section insert—13In section 267(3) (regulations subject to the affirmative procedure), after paragraph (e) insert—
I65I47175 Fees and reasons for responses to data subjects’ requests about law enforcement processing¶
1The 2018 Act is amended as follows.2In section 53 (manifestly unfounded or excessive requests by the data subject under Part 3)—aafter subsection (4) insert—
,
bin subsection (5), for “subsection (4)” substitute “this section”, andcafter subsection (5) insert—3In section 54(1) (meaning of “applicable time period”), for “and 48(2)(b)” substitute “, 48(2)(b) and 53(7)”.
I237I43376 Time limits for responding to data subjects’ requests¶
1The UK GDPR is amended in accordance with subsections (2) and (3).2In Article 12 (transparent information, communication and modalities for the exercise of rights of the data subject)—ain paragraph 3—ifor “within one month of receipt of the request” substitute “before the end of the applicable time period (see Article 12A)”, andiiomit the second and third sentences,bin paragraph 4, for “without delay and at the latest within one month of receipt of the request” substitute “without undue delay, and in any event before the end of the applicable time period (see Article 12A),”, andcin paragraph 6—iafter “may” insert
, and
iiat the end insert 3After Article 12 insert—4The 2018 Act is amended in accordance with subsections (5) to (7).5In section 45(5) (right of access by the data subject), after “delay” insert “and in any event before the end of the applicable time period (as to which see section 54)”.6In section 54 (meaning of “applicable time period” for responding to data subjects’ requests)—ain subsection (1), after “45(3)(b)” insert “and (5)”,bin subsection (2)—ifor “1 month, or such longer period as may be specified in regulations,” substitute “one month”, andiiat the end insert “, subject to subsection (3A)”,cafter subsection (3) insert—
, and
domit subsections (4) to (6).7In section 94 (right of access under Part 4)—ain subsection (14), for the definition of “the applicable time period” substitute—
, and
bafter subsection (14) insert—
I370I43477 Information to be provided to data subjects¶
1In Article 13 of the UK GDPR (information to be provided where personal data is collected from the data subject)—ain paragraph 4, for “shall not apply where and insofar as” substitute “do not apply to the extent that”, andbat the end insert—2In Article 14 of the UK GDPR (information to be provided where personal data is not obtained from the data subject)—ain paragraph 5—ifor “shall not apply where and insofar as” substitute “do not apply to the extent that”,iiomit point (b),iiiomit the “or” at the end of point (c),ivin point (d), omit “where”, andvafter that point insert—
, and
bat the end insert—
I18578 Searches in response to data subjects’ requests¶
1In Article 15 of the UK GDPR (right of access by the data subject)—aafter paragraph 1 insert—
, and
bin paragraph 3, after “processing” insert “to which the data subject is entitled under paragraph 1”.2The 2018 Act is amended in accordance with subsections (3) and (4).3In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—4In section 94 (intelligence services processing: right of access by the data subject), after subsection (2) insert—5The amendments made by this section are to be treated as having come into force on 1 January 2024.
I326I8679 Data subjects’ rights to information: legal professional privilege exemption¶
1The 2018 Act is amended as follows.2In section 43 (overview and scope of Chapter 3 of Part 3: rights of the data subject in connection with law enforcement processing)—ain subsection (1)(a), for “section 44” substitute “sections 44 and 45A”, andbin subsection (1)(b), for “section 45” substitute “sections 45 and 45A”.3For the italic heading before section 44 substitute—
.
4In the heading of section 44, omit “Information:”.5Omit the italic heading before section 45.6After that section insert—7In section 51 (exercise of rights through the Commissioner)—ain subsection (1), after paragraph (b) (but before the “or” at the end of that paragraph) insert—
1For Article 22 of the UK GDPR (automated individual decision-making, including profiling) substitute—2The 2018 Act is amended in accordance with subsections (3) to (5).3For sections 49 and 50 (law enforcement processing: automated individual decision-making) substitute—4In section 96 (intelligence services processing: right not to be subject to automated decision-making)—ain subsection (1), for “solely on” substitute “on entirely”,bin subsection (3), after “section” insert “and section 97”, andcat the end insert—5In section 97 (intelligence services processing: right to intervene in automated decision-making)—ain subsection (1)(a), for “solely on” substitute “on entirely”,bin subsection (4)(b), for “solely on” substitute “on entirely”, andcomit subsection (6).6Schedule 6 to this Act contains minor and consequential amendments.
I310I43681 Data protection by design: children’s higher protection matters¶
1Article 25 of the UK GDPR (data protection by design and by default) is amended as follows.2After paragraph 1 insert—3In paragraph 3, for “1 and 2” substitute “1 to 2”.4At the end insert—
In section 62 of the 2018 Act (logging of law enforcement processing)—ain subsection (2)(a), omit “justification for, and”, andbin subsection (3)(a), omit “justification for, and”.
I318I43783 General processing and codes of conduct¶
In Article 41 of the UK GDPR (monitoring of approved codes of conduct)—ain paragraph 4, omit the words from “, including suspension” to the end, andbafter that paragraph insert—
I156I24484 Law enforcement processing and codes of conduct¶
1The 2018 Act is amended as follows.2In section 55(1) (overview and scope of provisions about controllers and processors), at the end insert—3In section 56 (general obligations of the controller), at the end insert—4In section 59 (processors), after subsection (7) insert—5In section 66 (security of processing), at the end insert—6After section 71 insert—
I192I52985 Transfers of personal data to third countries and international organisations¶
1Schedule 7 amends Chapter 5 of the UK GDPR (general processing and transfers of personal data to third countries and international organisations).2Schedule 8 amends Chapter 5 of Part 3 of the 2018 Act (law enforcement processing and transfers of personal data to third countries and international organisations).3In Schedule 9—aPart 1 contains minor and consequential amendments, andbPart 2 contains transitional provision.
Safeguards for processing for research etc purposes¶
I225I43886 Safeguards for processing for research etc purposes¶
1The UK GDPR is amended in accordance with subsections (2) to (4).2After Chapter 8 insert—3In the heading of Chapter 9, after “relating to” insert “other”.4Omit Article 89 (safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes).5The 2018 Act is amended in accordance with subsections (6) and (7).6Omit section 19 (processing for archiving, research and statistical purposes: safeguards) and the italic heading before it.7In section 41(1) (safeguards: archiving), for “necessary” substitute “carried out”.
1In the UK GDPR—ain Article 5(1)(e) (storage limitation), for “Article 89(1)” to “data subject” substitute “Article 84B”,bin Article 9(2)(j) (processing of special categories of personal data), for “in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act)” substitute “, is carried out in accordance with Article 84B and is”,cin Article 17(3)(d) (right to erasure), for “Article 89(1)” substitute “Article 84B”, anddin Article 21(6) (right to object), omit “pursuant to Article 89(1)”.2In the 2018 Act—ain section 24(4) (manual unstructured data held by FOI public authorities), after paragraph (b) insert—
,
bin paragraph 4(b) of Schedule 1 (special categories of personal data and criminal convictions etc data: research etc), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, andcin Schedule 2 (exemptions etc from the UK GDPR)—iin paragraph 27(3)(a) (research and statistics), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, andiiin paragraph 28(3) (archiving), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”.3In section 279(2) of the Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13) (information for research), for “Article 89(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics)” substitute “Article 84A of the UK GDPR (research, archives and statistics)”.
1The 2018 Act is amended in accordance with subsections (2) to (10).2In section 26(2)(f) (national security and defence exemption), before sub-paragraph (i) insert—
.
3In section 44 (controller’s general duties to provide information to data subject)—ain subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),bin subsection (5), after “restricted” insert “under subsection (4)”, andcin subsection (7)(a), after “subsection (2)” insert “in reliance on subsection (4)”.4In section 45 (right of access by the data subject)—ain subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),bin subsection (5), after “restricted” insert “under subsection (4)”, andcin subsection (7)(a), after “subsection (1)” insert “in reliance on subsection (4)”.5In section 48 (requests by data subject for rectification or erasure of personal data)—ain subsection (3), omit paragraph (d) (grounds for restricting information provided: national security),bin subsection (4)—ifor “(1)” substitute “(1)(b)(i)”, andiiafter “restricted” insert “under subsection (3)”, andcin subsection (6)(a), after “subsection (1)(b)(i)” insert “in reliance on subsection (3)”.6In section 68(7) (communication of a personal data breach to the data subject: grounds for restricting information provided), omit paragraph (d) (national security).7In Chapter 6 of Part 3 (law enforcement processing: supplementary), before section 79 insert—8In section 79 (national security: certificate)—aomit subsections (1) to (3),bafter subsection (3) insert—
,
cin subsection (4), for “subsection (1)” substitute “subsection (3A)—
,
din subsection (5), for “subsection (1)” substitute “subsection (3A)”,ein subsection (7)—ifor “a restriction falls within a general description in a certificate issued under subsection (1)” substitute “a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data”, andiifor “the restriction does not fall within that description” substitute “the certificate does not apply to the personal data in question”,fin subsection (8)—ifor “the restriction” substitute “the certificate”, andiifor “to fall within the general description” substitute “so to apply”,gin subsection (10), for “subsection (1)” substitute “subsection (3A)”,hin subsection (11), for “subsection (1)” substitute “subsection (3A)”,iin subsection (12), for “subsection (1)” substitute “subsection (3A)”, andjomit subsection (13).9In section 110(2) (intelligence services processing: national security)—ain paragraph (a), after “Chapter 2” insert “of this Part”,bin paragraph (b), after “Chapter 3” insert “of this Part”, andcin paragraph (c), after “Chapter 4” insert “of this Part”.10In section 186(3) (data subject’s rights etc: exceptions), after paragraph (c) insert—
.
11In the provisions listed in subsection (12), for “subsection (4) of that section” substitute “section 45(4) or 78A of that Act”.12The provisions are—asection 40(4A)(b) and (5B)(d) of the Freedom of Information Act 2000 (personal data which is exempt information);bsection 38(3A)(b) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);cregulation 13(3A)(b) and (5B)(d) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);dregulation 11(4A)(b) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);eregulation 45(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);fregulation 39(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information).
I26I36089 Joint processing by intelligence services and competent authorities¶
1Part 4 of the 2018 Act (intelligence services processing) is amended as follows.2In section 82 (processing to which Part 4 applies)—abefore subsection (1) insert—
,
bin subsection (1)—iafter “applies” insert “only”,iiin paragraph (a), for “the processing by an intelligence service” substitute “processing”, andiiiin paragraph (b), for “the processing by an intelligence service” substitute “processing”,cafter subsection (2) insert—
1The 2018 Act is amended in accordance with subsections (2) to (9).2In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”.3In section 29 (processing to which Part 3 applies), after subsection (1) insert—4In section 83 (meaning of “controller” and “processor” in Part 4)—abefore subsection (1) insert—
,
bin subsection (1), for the words before paragraph (a) substitute “This subsection is satisfied by a person who—”, andcin subsection (2), for “intelligence service on which” substitute “person on whom”.5In section 84 (other definitions)—aafter subsection (2) insert—
, and
bbefore subsection (7) insert—6In section 104(1) (joint controllers), for “intelligence services” substitute “controllers”.7In section 202(1)(a)(i) (proceedings in the First-tier Tribunal: contempt) after “79,” insert “82E,”.8In section 203(1) (Tribunal Procedure Rules), after “79,” insert “82E,”.9In section 206 (index of defined expressions), in the Table—ain the entry for “competent authority”—ifor “Part 3” substitute “Parts 3 and 4”, andiifor “section 30” substitute “sections 30 and 82”, andbat the appropriate places insert—
;
;
.
10In section 199(2)(a) of the Investigatory Powers Act 2016 (bulk personal datasets: meaning of “personal data”), after “section 82(1) of that Act” insert “by an intelligence service”.
I418I20291 Duties of the Commissioner in carrying out functions¶
1The 2018 Act is amended in accordance with subsections (2) to (4).2Omit section 2(2) (duty of Commissioner when carrying out functions).3After section 120 insert—4In section 139 (reporting to Parliament), after subsection (1) insert—5The Information Commissioner must prepare and publish a strategy in accordance with section 120C of the 2018 Act before the end of the period of 18 months beginning with the day on which this section comes into force.
I168I23092 Codes of practice for the processing of personal data¶
1The 2018 Act is amended in accordance with subsections (2) to (6).2After section 124 insert—3In section 125 (approval of codes prepared under sections 121 to 124)—ain the heading, for “124” substitute “124A”,bin subsection (1), for “or 124” substitute “, 124 or 124A”,cin subsection (3), for “or 124” substitute “, 124 or 124A”,dfor subsection (5) substitute—
, and
ein subsection (9), for “or 124” substitute “, 124 or 124A”.4In section 126 (publication and review of codes issued under section 125(4)), in subsection (4), for “or 124(2)” substitute “, 124(2) or 124A(3)”.5Omit section 128 (other codes of practice).6In section 129 (consensual audits), in subsection (3), for “128” substitute “124A”.7In section 19AC of the Registration Service Act 1953 (code of practice), in subsection (11), for “128” substitute “124A”.8In the Statistics and Registration Service Act 2007—ain section 45 (information held by HMRC), in subsection (4A), for “128” substitute “124A”,bin section 45A (information held by other public authorities), in subsection (8), for “128” substitute “124A”,cin section 45E (further provisions about powers in sections 45B, 45C and 45D), in subsection (16), for “128” substitute “124A”, anddin section 53A (disclosure by the Board to devolved administrations), in subsection (9), for “128” substitute “124A”.9In the Digital Economy Act 2017—ain section 43 (code of practice), in subsection (13), for “128” substitute “124A”,bin section 52 (code of practice), in subsection (13), for “128” substitute “124A”,cin section 60 (code of practice), in subsection (13), for “128” substitute “124A”, anddin section 70 (code of practice), in subsection (15), for “128” substitute “124A”.
I76I41093 Codes of practice: panels and impact assessments¶
In the 2018 Act, after section 124A (inserted by section 92 of this Act) insert—
I75I44094 Manifestly unfounded or excessive requests to the Commissioner¶
1The 2018 Act is amended in accordance with subsections (2) and (3).2In section 135 (manifestly unfounded or excessive requests made to the Commissioner)—abefore subsection (1) insert—
,
bin subsection (1) omit the words from the beginning to “excessive,”,cafter subsection (1) insert—
,
din subsection (3), for “(1)” substitute “(A1)”,eomit subsection (4), andfafter that subsection insert—3In section 136(1) (guidance about fees), omit paragraph (b) and the “or” before it.4In Article 57 of the UK GDPR (Commissioner’s tasks), omit paragraph 4.
1The 2018 Act is amended in accordance with subsections (2) and (3).2Omit section 141 (notices from the Commissioner).3After that section insert—4In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers), in paragraph 1(b), for “141” substitute “141A”.
I27697 Power of the Commissioner to require documents¶
1The 2018 Act is amended as follows.2In section 142 (information notices)—ain subsection (1)—iin paragraph (a), after “information” insert “or documents”, andiiin paragraph (b), after “information” insert “or documents”,bin subsection (2)(b), after “information” insert “or documents”,cin subsection (3)—iin paragraph (a), after “information”, in both places it occurs, insert “or documents”,iiin paragraph (b), after “information” insert “or documents”,iiiin paragraph (c), after “information” insert “or documents”, andivin paragraph (d), after “information” insert “or documents”,din subsection (5), after “information”, in the second place it occurs, insert “or documents”,ein subsection (6), after “information”, in the second place it occurs, insert “or documents”, andfin subsection (7)—iin paragraph (a), for “is” substitute “or documents are”, andiiin the words after paragraph (b), after “information” insert “or documents”.3In section 143 (information notices: restrictions)—ain subsection (1)(b)(ii), for “is” substitute “or documents are”,bin subsection (2), after “information”, in the second place it occurs, insert “or documents”,cin subsection (3), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”,din subsection (4), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”, andein subsection (6), after “information”, in the second place it occurs, insert “or documents”.4In section 145 (information orders)—ain subsection (2)—iin paragraph (a), after “information”, in the first place it occurs, insert “or documents”, andiiin paragraph (b), after “information” insert “or documents”, andbin subsection (3)—iin paragraph (a), after “information” insert “or documents”,iiin paragraph (b), after “information” insert “or documents”, andiiiin paragraph (c), after “information” insert “or documents”.5In section 148(1) (destroying or falsifying information and documents etc), in paragraph (a), after “information”, in the second place it occurs, insert “or a document”.6In section 160 (guidance about regulatory action), in subsection (3)(a), for “is” substitute “or documents are”.7In Schedule 17 (review of processing of personal data for the purposes of journalism), in paragraph 2(2) (information notices)—ain paragraph (a), for “is” substitute “or documents are”, andbin the words after paragraph (b), after “information” insert “or documents”.
I167I47298 Power of the Commissioner to require a report¶
1The 2018 Act is amended as follows.2In section 146 (assessment notices)—ain subsection (2), after paragraph (i), insert—
,
bafter subsection (3) insert—
,
cafter subsection (11) insert—
, and
din subsection (12), before the definition of “domestic premises” insert—
.
3After section 146 insert—4In section 155 (penalty notices), in subsection (1)—aomit the “or” at the end of paragraph (a), andbat the end of paragraph (b) insert 5In section 160 (guidance about regulatory action), in subsection (4), after paragraph (a) insert—
.
I378I47399 Assessment notices: removal of OFSTED restriction¶
In section 147 of the 2018 Act (assessment notices: restrictions), in subsection (6), omit paragraph (b) and the “or” before it.
1The 2018 Act is amended as follows.2After section 148 insert—3In section 149 (enforcement notices), in subsection (9)(b)—aafter “an assessment notice” insert “, an interview notice”, andbafter “147” insert “, 148A, 148B”.4In section 155 (penalty notices), in subsection (1)(b), after “assessment notice” insert “, an interview notice”.5In section 157 (maximum amount of penalty), in subsection (4), after “assessment notice” insert “, an interview notice”.6In section 160 (guidance about regulatory action)—ain subsection (1), after paragraph (b) insert—
, and
bafter subsection (5) insert—7In section 162 (rights of appeal), in subsection (1), after paragraph (b) insert—
.
8In section 164 (applications in respect of urgent notices)—ain subsection (1), after “assessment notice” insert “, an interview notice”, andbin subsection (5), after paragraph (b) (but before the “and” at the end of that paragraph) insert—
.
9In section 181 (interpretation of Part 6), at the appropriate place, insert—
““interview notice” has the meaning given in section 148A;”.
10In section 196 (penalties for offences), in subsection (2), after “148,” insert “148C,”.11In section 206 (index of defined expressions), at the appropriate place, insert—
.
12In Schedule 17 (review of processing of personal data for the purposes of journalism)—aafter paragraph 3 insert—
, and
bin paragraph 4 (applications in respect of urgent notices)—ifor “or assessment notice” substitute “, assessment notice or interview notice”,iifor “or 3(2)(a)” substitute “, 3(2)(a) or 3A(2)(a)”, andiiifor “or 146(8)(a)” substitute “, 146(8)(a) or 148A(8)(a)”.
1The 2018 Act is amended as follows.2In paragraph 2 of Schedule 16 (notice of intent to impose penalty), omit sub-paragraphs (2) and (3).3In paragraph 4 of that Schedule (giving a penalty notice)—abefore sub-paragraph (1) insert—
,
bin sub-paragraph (1)—iat the beginning, insert “But”, andiiafter “penalty notice” insert “to the person”, andcin sub-paragraph (2), for “a person” substitute “the person”.4In section 160 (guidance about regulatory action), in subsection (7), after paragraph (d) insert—
1The 2018 Act is amended as follows.2In section 139 (reporting to Parliament), before subsection (3) insert—3In the italic heading before section 160, at the end insert “and report”.4After section 161 insert—
1The 2018 Act is amended in accordance with subsections (2) and (3).2Before section 165 (but after the italic heading before it) insert—3In section 165 (complaints by data subjects to the Commissioner)—aomit subsection (1), andbin subsection (2), after “infringement of” insert “the UK GDPR or”.4The UK GDPR is amended in accordance with subsections (5) and (6).5In Article 57 (Commissioner’s tasks)—ain paragraph 1, omit point (f), andbomit paragraph 2.6Omit Article 77 (right to lodge a complaint with the Commissioner).7Schedule 10 to this Act contains minor and consequential amendments.
I139I252104 Court procedure in connection with subject access requests¶
1The 2018 Act is amended as follows.2For the italic heading before section 180 substitute—
.
3After section 180 insert—
I108I476105 Consequential amendments to the EITSET Regulations¶
1Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers) is amended as follows.2In paragraph 1 (provisions of the 2018 Act applied for enforcement purposes)—aafter paragraph (g) insert—
, and
bafter paragraph (i) insert—
.
3In paragraph 4(2) (modification of section 143 (information notices: restrictions))—ain paragraph (b), for “or 148” substitute “, 148 or 148C”, andbin paragraph (c), after “148” insert “or 148C”.4In paragraph 6 (modification of section 146 (assessment notices)), in sub-paragraph (2)—afor paragraph (b) substitute—
,
bin paragraph (c), for “subsections (7), (8), (9) and (10)” substitute “subsections (3A), (7), (8), (9), (10) and (11A)”, andcin paragraph (d), for “or 148” substitute “, 148 or 148C”.5After paragraph 6 insert—6After paragraph 7 insert—7In paragraph 12 (modification of Schedule 15 (powers of entry and inspection)), in sub-paragraph (2), in the substituted paragraph (a), for “or 148” substitute “, 148 or 148C”.8In paragraph 13 (modification of section 155 (penalty notices)), in sub-paragraph (3)(c), for “for “data subjects”” there were substituted “for the words from “data subjects” to the end”.9Omit paragraph 21 (modification of section 182 (regulations and consultation)) and the heading before it.10In paragraph 22 (modification of section 196 (penalties for offences)), in sub-paragraph (2)(b)—aafter “148”, in the first place it occurs, insert “, 148C”, andbfor “or 148” substitute “, 148 or 148C”.
Protection of prohibitions, restrictions and data subject’s rights¶
I69I135106 Protection of prohibitions, restrictions and data subject’s rights¶
1The 2018 Act is amended in accordance with subsections (2) to (5).2After section 183 insert—3Before section 184 (and the italic heading before it) insert—4In section 186 (data subject’s rights and other prohibitions and restrictions)—afor the heading substitute “Protection of data subject’s rights”,bin subsection (1) omit “, except as provided by or under the provisions listed in subsection (3)”,cafter subsection (2) insert—
, and
din subsection (3)—ifor “provisions providing exceptions” substitute “provisions referred to in subsection (2A)(b)”, andiiomit paragraph (c) (and the “and” after it).5After section 186 insert—6In section 5 of the European Union (Withdrawal) Act 2018 (exceptions to savings and incorporation), in subsection (A3)(a)—afor “section” substitute “sections 183A and”,bfor “(data subject’s rights and other prohibitions and restrictions)” substitute “(protection of prohibitions, restrictions and data subject’s rights)”, andcat the end insert “(and see also section 183B(3) of that Act)”.7Subsections (3), (5) and (6)(c) are to be treated as having come into force on 1 January 2024.
1In the UK GDPR, after Chapter 9 insert—2In section 3(9) of the 2018 Act (definition of “data protection legislation”), in paragraph (d), after “Act” insert “or the UK GDPR”.
I272I100108 Further minor provision about data protection¶
Schedule 11 contains further minor provision about data protection.
I1641Regulation 2 of the PEC Regulations (interpretation) is amended as follows.2In paragraph (1)—I514ain the definition of “call”, at the end insert “, and a reference to making a call includes a reference to attempting to establish such a connection”,I514bin the definition of “communication”—ifor “exchanged or conveyed between” substitute “transmitted to”, andiifor “conveyed”, in the second place it occurs, substitute “transmitted”, andI164cat the appropriate place insert—
.
I5143After paragraph (1) insert—I1644In paragraph (4) omit “, without prejudice to paragraph (3),”.I1645After that paragraph insert—
I154I150111 Duty to notify the Commissioner of personal data breach: time periods¶
1In regulation 5A of the PEC Regulations (personal data breach)—ain paragraph (2), after “delay” insert “and, where feasible, not later than 72 hours after having become aware of it”, andbafter paragraph (3) insert—2In regulation 5C of the PEC Regulations (personal data breach: fixed monetary penalty)—ain paragraph (4)(f), for “from the service of the notice of intent” substitute “beginning when the notice of intent is served”, andbin paragraph (5), for “21 days of receipt of the notice of intent” substitute “the period of 21 days beginning when the notice of intent is received”.3In Article 2 of Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (notification to the Commissioner)—ain paragraph 2—iin the first subparagraph, for the words from “no” to “feasible” substitute “without undue delay and, where feasible, not later than 72 hours after having become aware of it”,iiin the second subparagraph, after “shall” insert “, subject to paragraph 3,”, andiiiafter the third subparagraph insert—
, and
bfor paragraph 3 substitute—
I416I515112 Storing information in the terminal equipment of a subscriber or user¶
1The PEC Regulations are amended in accordance with subsections (2) and (3).2For regulation 6 (storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user) substitute—3After regulation 6 insert—4Schedule 12 to this Act inserts Schedule A1 to the PEC Regulations.5A requirement to consult under regulation 6A of the PEC Regulations (inserted by subsection (3) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
I374I425113 Emergency alerts: interpretation of time periods¶
In regulation 16A of the PEC Regulations (emergency alerts), in paragraph (6), for the words from “7 days” to “paragraph (3)(b)” substitute “the period of 7 days beginning with the day on which the time period specified by the relevant public authority pursuant to paragraph (3)(b) expires”.
I339I516114 Use of electronic mail for direct marketing by charities¶
1Regulation 22 of the PEC Regulations (use of electronic mail for direct marketing purposes) is amended as follows.2In paragraph (2), after “paragraph (3)” insert “or (3A)”.3After paragraph (3) insert—4After paragraph (4) insert—
1The PEC Regulations are amended in accordance with subsections (2) to (8).2In regulation 5 (security of public electronic communications services), omit paragraph (6).3Omit regulation 5B (personal data breach: audit).4In regulation 5C (personal data breach: fixed monetary penalty)—ain paragraph (10)—iomit “and Northern Ireland”, andiiin paragraph (a), for “a county court” substitute “the county court”, andbafter paragraph (11) insert—5For regulation 31 substitute—6Omit regulation 31A (third party information notices).7Omit regulation 31B (appeals against third party information notices).8For Schedule 1 substitute the Schedule set out in Schedule 13 to this Act.9In paragraph 58(1) of Schedule 20 to the Data Protection Act 2018 (transitional provision relating to the PEC Regulations) for “regulations 2, 31 and 31B of, and Schedule 1 to,” substitute “regulation 2 of”.10A requirement to consult under regulation 5C(15) of the PEC Regulations (inserted by subsection (4)(b) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
1The PEC Regulations are amended as follows.2After regulation 32 insert—3In regulation 33 (technical advice to the Commissioner)—aomit “, in connection with his enforcement functions,” andbat the end insert 4In Schedule 1 (Commissioner’s enforcement powers) (inserted by Schedule 13 to this Act), in paragraph 18(b)(ii) (maximum amount of penalty), for “or 24” substitute “, 24 or 32B(4) or (5)”.
1The Data Protection Act 2018 is amended in accordance with subsections (2) to (5).2After section 114 insert—3In section 3 (terms relating to the processing of personal data), after subsection (8) insert—4In section 205(2) (references to periods of time)—aomit paragraph (l), andbafter that paragraph insert—
.
5In section 206 (index of defined expressions), in the Table, at the appropriate place insert—
.
6Schedule 14 to this Act—ainserts Schedule 12A to the Data Protection Act 2018, andbmakes transitional provision relating to—ithe person who holds the office of Information Commissioner immediately before the day on which Schedule 14 comes into force, andiiconsultation about certain appointments.
I292118 Abolition of the office of Information Commissioner¶
1The office of Information Commissioner is abolished.2Accordingly, the Data Protection Act 2018 is amended as follows.3In section 3 (terms relating to the processing of personal data) omit subsection (8).4Omit section 114 (the Information Commissioner) and the italic heading before that section.5In section 206 (index of defined expressions), in the Table, omit the entry for the Commissioner.6In section 214(1) (extent)—aomit “and” at the end of paragraph (a), andbomit paragraph (b).7Omit Schedule 12 (the Information Commissioner).
I212119 Transfer of functions to the Information Commission¶
1The functions of the Information Commissioner are transferred to the Information Commission.2So far as is appropriate in consequence of subsection (1), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made (including this Act) is to be treated as a reference to the Information Commission.3In this section, “enactment” includes—aan enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978),ban enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,can enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,dan enactment comprised in, or in an instrument made under, Northern Ireland legislation, andeassimilated direct legislation.
I203I530120 Transfer of property etc to the Information Commission¶
1The Secretary of State may make a scheme for the transfer of property, rights and liabilities from the Information Commissioner to the Information Commission.2The things that may be transferred under a transfer scheme include—aproperty, rights and liabilities that could not otherwise be transferred;bproperty acquired, and rights and liabilities arising, after the making of the scheme.3A transfer scheme may—amake provision about the continuing effect of things done by the Information Commissioner in respect of anything transferred;bmake provision about the continuation of things (including legal proceedings) in the process of being done by, on behalf of or in relation to the Information Commissioner in respect of anything transferred;cmake provision for references to the Information Commissioner in an instrument or other document in respect of anything transferred under a transfer scheme to be treated as references to the Information Commission;dmake provision which is the same as or similar to the Transfer of Undertakings (Protection of Employment) Regulations 2006 (S.I. 2006/246);emake other consequential, supplementary, incidental or transitional provision.4A transfer scheme may provide—afor modifications by agreement;bfor modifications to have effect from the date when the original scheme came into effect.5In this section, references to rights and liabilities include rights and liabilities relating to a contract of employment.
Part 7 Other provision about use of, or access to, data¶
I391I531121 Information standards for health and adult social care in England¶
Schedule 15 makes provision about information standards for health and adult social care in England (under Part 9 of the Health and Social Care Act 2012) and information technology.
I303I548123 Disclosure of information to improve public service delivery to undertakings¶
1Section 35 of the Digital Economy Act 2017 (disclosure of information to improve public service delivery) is amended as follows.2In subsection (9)—ain paragraph (a), for “or households” substitute “, households or undertakings”, andbin paragraph (b), for “or households” substitute “, households or undertakings”.3In subsection (10)—athe words after “its purpose” become paragraph (a), andbat the end of that paragraph, insert 4After subsection (12) insert—
Retention of information by providers of internet services¶
I334I42124 Retention of information by providers of internet services in connection with death of child¶
1The Online Safety Act 2023 is amended as follows.2In section 100 (power to require information)—aomit subsection (7);bafter subsection (8) insert—3In section 101 (information in connection with investigation into death of child)—abefore subsection (1) insert—
;
bin subsection (3), for “power conferred by subsection (1) includes” substitute “powers conferred by this section include”;cafter subsection (5) insert—4In section 102 (information notices)—ain subsection (1), for “101(1)” substitute “101(C1) or (1)”;bin subsection (3)—iafter “information notice” insert “under section 100(1) or 101(1)”;iiomit the “and” at the end of paragraph (c);iiiafter paragraph (c) insert—
fin subsection (10), after the definition of “information” insert—
.
5In section 109 (offences in connection with information notices)—ain subsection (2)(b), for “all reasonable steps” substitute “all of the steps that it was reasonable, and reasonably practicable, to take”;bafter subsection (6) insert—6In section 110 (senior managers’ liability: information offences)—aafter subsection (6) insert—
;
bin subsection (7), for “or (6)” substitute “, (6) or (6A)”.7In section 113 (penalties for information offences), in subsection (2)—afor “(4) or (5)” substitute “(4), (5) or (6A)”;bfor “(5) or (6)” substitute “(5), (6) or (6A)”.8In section 114 (co-operation and disclosure of information: overseas regulators), in subsection (7), omit the definition of “the data protection legislation”.9In section 225 (Parliamentary procedure for regulations), in subsection (10), after paragraph (c) insert—
.
10In section 236(1) (interpretation)—aafter the definition of “country” insert—
;
bin the definition of “information notice”, for “101(1)” substitute “101(C1) or (1)”.11In section 237 (index of defined terms), after the entry for “CSEA content” insert—
.
Information for research about online safety matters¶
I25I54125 Information for research about online safety matters¶
1The Online Safety Act 2023 is amended in accordance with subsections (2) to (4).2After section 154 insert—3In section 162 (OFCOM’s report about researchers’ access to information), omit subsections (7) to (10).4In section 225 (Parliamentary procedure for regulations), for subsections (8) and (9) substitute—5The requirement to consult under section 154A(7) of the Online Safety Act 2023 (as inserted by subsection (2) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
I213126 Retention of biometric data and recordable offences¶
1Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (10).2In section 18A(3) (retention of material: general), after “recordable offence” insert “or recordable-equivalent offence”.3Section 18E (supplementary provision) is amended in accordance with subsections (4) to (10).4In subsection (1), after the definition of “recordable offence” insert—
.
5In subsection (3), in the words before paragraph (a), after “offence” insert “in England and Wales or Northern Ireland”.6After subsection (5) insert—7In subsection (6)(a)—aafter “convicted” insert
, and
bafter “offence,” insert
.
8In subsection (6)(b)—aomit “of a recordable offence”, andbfor “a recordable offence, other than a qualifying offence” substitute “an offence, other than a qualifying offence or qualifying-equivalent offence”.9In subsection (7), for “subsection (6)” substitute “this section”.10After subsection (7) insert—11The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—aon or after the commencement day, orbin the period of 3 years ending immediately before the commencement day.12Subsection (13) of this section applies where—aat the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day,bat a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, andcat the pre-commencement time, the law enforcement authority could have retained the material under section 18A of the Counter-Terrorism Act 2008, as it has effect taking account of the amendments made by subsections (2) to (10) of this section, if those amendments had been in force.13Where this subsection applies—athe law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, butbthe material may not be used in evidence against the person to whom the material relates—iin criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, oriiin criminal proceedings in any other country or territory.14In this section—
“the commencement day” means the day on which this Act is passed;
“law enforcement authority” has the meaning given by section 18E(1) of the Counter-Terrorism Act 2008;
“section 18 material” has the meaning given by section 18(2) of that Act.
15For the purposes of this section, proceedings in relation to an offence are instituted—ain England and Wales, when they are instituted for the purposes of Part 1 of the Prosecution of Offences Act 1985 (see section 15(2) of that Act);bin Northern Ireland, when they are instituted for the purposes of Part 2 of the Justice (Northern Ireland) Act 2002 (see section 44(1) and (2) of that Act);cin Scotland, when they are instituted for the purposes of Part 3 of the Proceeds of Crime Act 2002 (see section 151(1) and (2) of that Act).
I176127 Retention of pseudonymised biometric data¶
1Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (6).2Section 18A (retention of material: general) is amended in accordance with subsections (3) to (5).3In subsection (1), for “subsection (5)” substitute “subsections (4) to (9)”.4In subsection (4)(a), after “relates” insert “(a “pseudonymised form”)”.5After subsection (6) insert—6In section 18E(1) (supplementary provision)—ain the definition of “law enforcement authority”, for paragraph (d) substitute—
, and
bafter that definition insert—
.
7The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—aon or after the commencement day, orbin the period of 3 years ending immediately before the commencement day.8Subsections (9) to (12) of this section apply where, at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day.9Where the law enforcement authority holds the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) and (d) of the Counter-Terrorism Act 2008 as having—ataken the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material, andbcontinued to hold the material in a pseudonymised form until the commencement day.10Where the law enforcement authority does not hold the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) of the Counter-Terrorism Act 2008 as taking the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material if it takes those steps on, or as soon as reasonably practicable after, the commencement day.11Subsection (12) of this section applies where, at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material but—aat the pre-commencement time, the law enforcement authority could have retained the material under section 18A(7) to (9) of the Counter-Terrorism Act 2008 (as inserted by this section) if those provisions had been in force, orbon or after the commencement day, the law enforcement authority may retain the material under those provisions by virtue of subsection (9) or (10) of this section.12Where this subsection applies—athe law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, butbthe material may not be used in evidence against the person to whom the material relates—iin criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, oriiin criminal proceedings in any other country or territory.13In this section—
“the commencement day”, “law enforcement authority” and “section 18 material” have the meaning given in section 126(14);
“in a pseudonymised form” has the meaning given by section 18A(4) of the Counter-Terrorism Act 2008 (as amended by this section);
“instituted”, in relation to proceedings, has the meaning given in section 126(15).
1Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (4).2In section 18(4) (destruction of national security material not subject to existing statutory restrictions), after “18A” insert “, 18AA”.3After section 18A insert—4In section 18BA(5)(a) (retention of further fingerprints), after “18A” insert “, 18AA”.5Section 18AA of the Counter-Terrorism Act 2008 applies in relation to section 18 material obtained or acquired by a law enforcement authority before the commencement day (as well as material obtained or acquired on or after that day), except where the law enforcement authority was informed, or became aware, as described in subsection (2) or (3) of that section before the commencement day.6Subsection (7) of this section applies where—aat the beginning of the commencement day, a law enforcement authority has section 18 material,bat a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, butcat the pre-commencement time, the law enforcement authority could have retained the material under section 18AA of that Act (as inserted by this section) if it had been in force.7Where this subsection applies—athe law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, butbthe material may not be used in evidence against the person to whom the material relates—iin criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, oriiin criminal proceedings in any other country or territory.8In this section—
“the commencement day”, “law enforcement authority” and “section 18 material” have the meaning given in section 126(14);
“instituted”, in relation to proceedings, has the meaning given in section 126(15).
In sections 130 to 134, “the eIDAS Regulation” means Regulation (EU) No. 910/2014 of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market.
I17I519130 Recognition of EU conformity assessment bodies¶
In Chapter 3 of the eIDAS Regulation (trust services), after Article 24A insert—
I235131 Removal of recognition of EU standards etc¶
1The Secretary of State may by regulations—aamend Article 24A of the eIDAS Regulation (recognition of EU standards etc for qualified trust services) so as to remove circumstances in which something is to be treated as qualified under that Regulation for the purposes of a provision or measure specified in paragraph 1 of that Article;brevoke that Article;crevoke Article 24B of the eIDAS Regulation (recognition of EU conformity assessment bodies);drevoke Article 51 of the eIDAS Regulation (transitional measures for electronic signatures);eamend a provision listed in subsection (3) so as to remove a reference to a trust service provider established in the EU;famend a provision listed in subsection (4) so as to remove a reference to European standards or provisions of equivalent EU law.2The power under subsection (1)(a) includes power to amend or remove an assumption in Article 24A(2) of the eIDAS Regulation.3The provisions mentioned in subsection (1)(e) are—aArticle 13(1) of the eIDAS Regulation;bArticles 2(1)(a) and 4(1)(a) of the Implementing Decision.4The provisions mentioned in subsection (1)(f) are—aArticle 24(2)(b) of the eIDAS Regulation;bArticles 2(2)(c)(7) and 4(2)(c)(7) of the Implementing Decision.5Regulations under this section may—ainclude transitional provision or savings, andbmake different provision for different purposes, including for the purposes of different provisions of the eIDAS Regulation.6Regulations under this section are subject to the negative resolution procedure.7In this section, “the Implementing Decision” means Commission Implementing Decision (EU) 2015/1506 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies pursuant to Articles 27(5) and 37(5) of the eIDAS Regulation.
I72I520132 Recognition of overseas trust products¶
1The eIDAS Regulation is amended as follows.2In Chapter 3 (trust services), after Article 45 insert—3In Article 3(21) (definition of “product”), at the end insert “(except in the expression “trust product”)”.
I261133 Co-operation between supervisory authority and overseas authorities¶
1Article 18 of the eIDAS Regulation (co-operation with EU authorities) is amended as follows.2In the heading, for “EU” substitute “overseas”.3In paragraph 1, for “public authority in the EU” substitute “designated overseas authority”.I5214In paragraph 2, for “other than in accordance with the data protection legislation” substitute “if the processing would contravene the data protection legislation (but in determining whether processing would do so, take into account the power conferred by that paragraph)”.5After paragraph 2 insert—
I388I21134 Time periods: the eIDAS Regulation and the EITSET Regulations¶
1In Chapter 1 of the eIDAS Regulation (general provisions), after Article 3 insert—2The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) are amended as follows.3In regulation 2 (interpretation), at the end insert—4In Schedule 1 (monetary penalties)—ain paragraph 4(f), for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”,bin paragraph 5, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is received”, andcin paragraph 6, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”.
Copyright works and artificial intelligence systems¶
1The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed—aprepare and publish an assessment of the economic impact in the United Kingdom of each of the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), andblay a document containing the assessment before Parliament.2The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection (1)(a).3An assessment included in the document must, among other things, include assessment of the economic impact of each option on—acopyright owners, andbpersons who develop or use AI systems,including the impact on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses.4In this section—
“AI system” means a machine-based system that, from the input it receives, can infer how to—
generate predictions, digital content, recommendations, decisions or other similar outputs, or
influence a physical or virtual environment,
with a view to achieving an explicit or implicit objective;
“the Copyright and AI Consultation Paper” means the command paper “Copyright and AI: Consultation”, numbered CP1205, published on 17 December 2024;
“copyright owner” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988;
“develop” an AI system means carry on an activity involved in producing the system, such as (for example) designing, programming, training or testing the system (and related terms are to be interpreted accordingly);
“digital content” means data which is produced and supplied in digital form;
“medium-sized business” means a business with at least 50 but fewer than 250 staff;
“micro business” means a business with fewer than 10 staff;
“small business” means a business with at least 10 but fewer than 50 staff;
“use” an AI system means instruct an AI system to generate outputs or to influence an environment (and related terms are to be interpreted accordingly).
I265I309136 Report on the use of copyright works in the development of AI systems¶
1The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed—aprepare and publish a report on the use of copyright works in the development of AI systems, andblay the report before Parliament.2The report must consider—athe four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), andbsuch alternative options as the Secretary of State considers appropriate.3The report must consider, and make proposals in relation to, each of the following—atechnical measures and standards (for example, measures and standards concerned with metadata) that may be used to control—ithe use of copyright works to develop AI systems, andiithe accessing of copyright works for that purpose (for example, by web crawlers);bthe effect of copyright on access to, and use of, data by developers of AI systems (for example, on text and data mining), including the effect on developers who are individuals, micro businesses, small businesses or medium-sized businesses;cthe disclosure of information by developers of AI systems about—itheir use of copyright works to develop AI systems, andiihow they access copyright works for that purpose (for example, by means of web crawlers);dthe granting of licences to developers of AI systems to do acts restricted by copyright, including the granting of licences by and to individuals, micro businesses, small businesses and medium-sized businesses;eways of enforcing requirements and restrictions relating to—ithe use of copyright works to develop AI systems, andiithe accessing of copyright works for that purpose (for example, by web crawlers),including enforcement by a regulator.4The consideration and proposals under each of paragraphs (a) to (e) of subsection (3) must include consideration of, and proposals relating to, AI systems developed outside the United Kingdom.5In preparing the report, the Secretary of State must consider the likely effect of proposals, in the United Kingdom, on—acopyright owners, andbpersons who develop or use AI systems,including the likely effect on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses.6In preparing the report, the Secretary of State must have regard to, among other things, the Consultation Paper responses.7The Secretary of State may comply with this section by preparing and publishing two or more reports which, taken together, satisfy the requirements in this section.8In this section—
“Consultation Paper responses” means responses to the Copyright and AI Consultation Paper received by the Secretary of State on or before 25 February 2025;
“copyright” means the property right which subsists in accordance with Part 1 of the Copyright, Designs and Patents Act 1988;
“copyright work” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988;
“web crawler” means a computer program that obtains data from websites in accordance with instructions and that can autonomously determine which websites to visit.
9Terms used in this section and in section 135 have the same meaning in this section as they have in that section.
1The Secretary of State must, before the end of the period of 6 months beginning with the day on which this Act is passed, lay before Parliament a statement setting out what progress has been made towards the publication of—athe economic impact assessment required by section 135, andbthe report required by section 136.2The duty in subsection (1) does not apply where the economic impact assessment and the report have been published before the end of the period described in that subsection.
I256I547138 Creating, or requesting the creation of, purported intimate image of adult¶
1The Sexual Offences Act 2003 is amended in accordance with subsections (2) and (3).2After section 66D insert—3In section 79(5) (meaning of references to image of a person), after “a person” insert “(except in sections 66E, 66F and 66G)”.4In the Armed Forces Act 2006, after section 177D insert—5In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert—6In the Sentencing Code, after section 154 insert—
1The Secretary of State may by regulations make provision that is consequential on any provision made by this Act.2Regulations under this section—amay make different provision for different purposes;bmay include transitional, transitory or saving provision;cmay amend, repeal or revoke any provision made by an enactment.3The reference in subsection (2)(c) to provision made by an enactment is—awhere the amendment, repeal or revocation is consequential on section 117, 118 or 119(1) or Schedule 14, a reference to provision made by an enactment whenever passed or made (including this Act), andbin any other case, a reference to provision made by an enactment passed or made before the end of the Session in which this Act is passed.4Regulations under this section made in consequence of section 183A of the Data Protection Act 2018 (inserted by section 106 of this Act) may amend, repeal or revoke provision which refers to the data protection legislation (as defined in section 3 of the Data Protection Act 2018) as they could if the provision referred instead to the main data protection legislation (as defined in section 183A of that Act).5Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.6Any other regulations under this section are subject to the negative resolution procedure.7In this section—
“enactment” includes—
an enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978),
an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,
an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,
an enactment comprised in, or in an instrument made under, Northern Ireland legislation, and
1Regulations under this Act are to be made by statutory instrument.2Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.3Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.4Any provision that may be included in regulations under this Act made by the Secretary of State or the Treasury subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure.
1This Act extends to England and Wales, Scotland and Northern Ireland, subject to subsections (2) to (5).2In Part 3 (National Underground Asset Register)—asections 56, 57(1) to (7) and 60(1) and Schedule 1 extend to England and Wales only, andbsections 58, 59 and 60(2) and Schedule 2 extend to Northern Ireland only.3In Part 4 (registers of births and deaths)—asections 61 to 64 extend to England and Wales only, andban amendment or repeal made by Schedule 3 (minor and consequential amendments) has the same extent as the enactment amended or repealed.4In Part 6 (the Information Commission), paragraph 23 of Schedule 12A to the Data Protection Act 2018 (inserted by Schedule 14 to this Act) extends to England and Wales and Northern Ireland only.5In Part 7—asection 121 and Schedule 15 (information standards for health and adult social care) extend to England and Wales only;bparagraphs 2, 3 and 5 to 7 of Schedule 16 (grant of smart meter communication licences) extend to England and Wales and Scotland only;csection 138(1) to (3) and (6) (creating, or requesting the creation of, purported intimate image of adult) extend to England and Wales only;dsection 138(4) (amendment of the Armed Forces Act 2006) extends to—iEngland and Wales, Scotland and Northern Ireland,iithe Isle of Man, andiiithe British overseas territories, except Gibraltar;esection 138(5) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.6The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 138(4) of this Act).7The power conferred by section 63(3) of the Immigration, Asylum and Nationality Act 2006 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modification or adaptation).8The power conferred by section 76(6) of the Immigration Act 2014 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).9The power conferred by section 95(5) of the Immigration Act 2016 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).10The power conferred by section 239(7) of the Online Safety Act 2023 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by this Act of any part of that Act (with or without modifications).11In this section, “enactment” has the same meaning as in section 139.
1Except as provided by subsections (2) to (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.2The following provisions come into force on the day on which this Act is passed—asection 66 (meaning of “the 2018 Act” and “the UK GDPR”);bsection 78 (searches in response to data subjects’ requests);cPart 1 of Schedule 16 (grant of smart meter communication licences) and section 122 so far as relating to that Part of that Schedule;dsection 126 (retention of biometric data and recordable offences);esection 127 (retention of pseudonymised biometric data);fsection 128 (retention of biometric data from INTERPOL);gthis Part;hany other provision of this Act (including provision modifying other legislation) so far as it confers power to make regulations or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed.3The following provisions come into force at the end of the period of two months beginning with the day on which this Act is passed—asection 69 (consent to law enforcement processing);bsection 82 (logging of law enforcement processing);csection 96 (notices from the Information Commissioner);dsection 97 (power of the Information Commissioner to require documents).4Part 2 of Schedule 16 (grant of smart meter communication licences), and section 122 so far as relating to that Part of that Schedule, come into force on the day on which the first regulations under section 91A(1) of the Energy Act 2008 (inserted by Part 1 of Schedule 16) come into force.5Regulations under this section may make different provision for different purposes.
I383143 Transitional, transitory and saving provision¶
1The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.2Regulations under this section may amend Schedule 21 to the Data Protection Act 2018 or Part 2 of Schedule 9 to this Act by adding, varying or repealing provision.3Regulations under this section containing provision described in subsection (2) are subject to the negative resolution procedure.4Regulations under this section may make different provision for different purposes.
Registers of births and deaths: minor and consequential amendments
Section 65
Part 1 Amendments of the Births and Deaths Registration Act 1953¶
I3471The Births and Deaths Registration Act 1953 is amended as follows.I27921Section 3A (registration of births of abandoned children) is amended as follows.2In subsection (5), for the words from “direct” to the end substitute “enter in the margin of the relevant register of births a reference to the re-registration of the birth or, if the relevant register of births is in hard copy form, shall direct the officer having custody of that register to do so.”3After that subsection insert—I31331Section 13 (registration of name of child or of alteration of name) is amended as follows.2In subsection (1), for “the registrar or superintendent registrar having the custody of the register” substitute “the relevant registration officer for the register”.3In subsection (1A), for “The registrar or superintendent registrar having custody of the register in question” substitute “The relevant registration officer”.4In subsection (1B), for “the registrar or superintendent registrar” substitute “the relevant registration officer”.5After subsection (2) insert—I954In Part 3 (general), the italic heading before section 25 becomes “Registers, etc”.I42051Section 29 (correction of errors in registers) is amended as follows.2In subsection (3), for “the officer having the custody of the register” substitute “the appropriate registration officer”.3In subsection (3A)(b), for “the officer having the custody of the register” substitute “the appropriate registration officer”.4In subsection (3B)(b), for “the officer having the custody of the register” substitute “the appropriate registration officer”.5In subsection (4), for “the officer having the custody of the register” substitute “the appropriate registration officer for the register”.6After subsection (4) insert—I2986In section 29A (alternative procedure for certain corrections), in subsection (4)—afor “the officer having custody of the register” substitute “the appropriate registration officer”;bat the end insert—I2771Section 30 (searches of indexes kept by Registrar General) is amended as follows.2After subsection (1) insert—3In subsection (2), after “certified copies” insert “or in the said registers (as the case may be)”.4In subsection (3)—afor “to certified copies of entries in” substitute “in relation to”;bfor the words from “any such” to the end substitute “any register of still-births”.I3358In section 31 (searches of indexes kept by superintendent registrars), for subsection (1) substitute—I2509For section 32 (searches in registers kept by registrars) substitute—I413101Section 33 (short certificate of birth) is amended as follows.2In subsection (1), for “the Registrar General, a superintendent registrar or a registrar” substitute “the appropriate registration officer”.3After subsection (1) insert—4In subsection (2)—afor the words from “the records and registers” to “may be” substitute “the register in which the entry relating to the birth is made, or, in the case of the Registrar General, from the records in the Registrar General’s custody”;bfor “any such records or registers” substitute “any register of births or in any such records”.I3311In section 33A (short certificate of death), in subsection (2), for the words from “the records and registers” to “may be” substitute “the register in which the entry relating to the death is made, or, in the case of the Registrar General, from the records in the Registrar General’s custody”.I13612In section 34 (entry in register as evidence of birth or death), in subsection (5), before “on which” insert “in or”.I170131Section 34A (searches and records of information: additional provision) is amended as follows.2In subsection (1)—aafter paragraph (a) insert—
;
bin paragraph (b), after “copies” insert “or in such a register”.3In subsection (5), at the end insert “or in a register kept under this Act”.I21714In section 35 (offences relating to registers), in paragraph (b), after “deaths” insert “kept in hard copy form”.I36115In section 40 (sending and providing notices, information or other documents), omit “, return”.I16216In section 41 (interpretation), after subsection (3) insert—
I27417The Registration Service Act 1953 is amended as follows.I41718In section 10 (district register offices), in subsection (1), omit the words from “, and shall provide” to the end.I19919In section 12 (provision of register boxes), omit “registrar of births and deaths and”.I12220In section 13 (local schemes of organisation), in subsection (2), after paragraph (b) insert—
In Schedule 1 to the Public Records Act 1958 (definition of public records), in paragraph 2(2)(b), after “adoptions,” insert “or to any other records held by the Registrar General of information entered in any register of births or deaths kept under any such enactment,”.
1Section 564 of the Education Act 1996 (certificates of birth and registrars’ returns) is amended as follows.2In subsection (1), for “the registrar having the custody of the register of births and deaths” substitute “the relevant registrar for the register”.3In subsection (3)—afor “A registrar” substitute “The relevant registrar for a register”;bfor “any register of births and deaths in his custody” substitute “the register”.4In subsection (4)—ain the definition of “the appropriate fee”, for “the registrar having custody of the register concerned” substitute “the relevant registrar for a register”;bfor the definition of “register of births and deaths” substitute—
In section 78 of the Adoption and Children Act 2002 (Adopted Children Register: searches and copies), in subsection (4)—ain paragraph (a), omit “certified copies of”;bin paragraph (b), for “certified copies”, in the second place it occurs, substitute “registers”.
I33725The Gender Recognition Act 2004 is amended as follows.I345261Section 10 (registration) is amended as follows.2In subsection (2), omit the “or” after paragraph (a) and after paragraph (b) insert
.
3For subsection (3) substitute—I11627In Part 1 of Schedule 3 (registration: England and Wales), in paragraphs 5(3) and 8(2), for “or (b)” substitute “, (b) or (c)”.
The UK GDPR is amended as follows.I79I44321Article 12 (transparent information, communication and modalities for the exercise of the rights of the data subject) is amended as follows.2In paragraph 1, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”.3In paragraph 2—afor “under Articles 15 to 22”, in the first place it occurs, substitute “arising under or by virtue of Articles 15 to 22D”, andbfor “his or her rights under Articles 15 to 22” substitute “those rights”.4In paragraph 3, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”.5In paragraph 5, for “under Articles 15 to 22” substitute “under or by virtue of Articles 15 to 22D”.6In paragraph 6, for “referred to in Articles 15 to 21” substitute “made under or by virtue of Articles 15 to 22D”.I70I4443In Article 13(2)(f) (information about automated decision-making to be provided where personal data is collected from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.I406I4454In Article 14(2)(g) (information about automated decision-making to be provided where personal data is not obtained from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.I366I4465In Article 15(1)(h) (right of access by the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.I277I4476In the heading of Section 4 of Chapter 3, omit “and automated decision-making”.I324I4487In Article 23(1) (restrictions), for “provided for in Articles 12 to 22”, in both places it occurs, substitute “arising under or by virtue of Articles 12 to 22D”.I404I4498In Article 47(2)(e) (binding corporate rules), for the words from “the right not” to “Article 22” substitute “the right to protection in accordance with, and with regulations made under, Articles 22A to 22D in connection with decisions based solely on automated processing (including decisions reached by means of profiling)”.I125I4509In Article 83(5) (general conditions for imposing administrative fines)—ain point (b), for “22” substitute “21”, andbafter that point insert—
The 2018 Act is amended as follows.I350I47911Omit section 14 (automated decision-making authorised by law: safeguards).I59I48012In section 43(1)(d) (overview and scope of provisions in Part 3 about rights of the data subject), for “sections 49 and 50” substitute “sections 50A to 50D”.I171I481131Section 52 (form of provision of information etc) is amended as follows.2In subsection (1), after “by” insert “or under”.3In subsection (3), for “by the data subject under section 45, 46, 47 or 50” substitute “made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”.4In subsection (4), for “under section 45, 46 or 47” substitute “under or by virtue of any of sections 45, 46, 47, 50C or 50D”.5In subsection (5), after “by” insert “or under”.6In subsection (6), for “under sections 45 to 50” substitute “arising under or by virtue of sections 45 to 50D”.I393I482141Section 53 (manifestly unfounded or excessive requests by the data subject) is amended as follows.2In subsection (1), for “from a data subject under section 45, 46, 47 or 50” substitute “made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”.3In subsection (3), for “under section 45, 46, 47 or 50” substitute “described in subsection (1)”.I412I48315In section 149(2)(b) (enforcement notices)—aafter “provision of” insert “or made under”, andbfor “22” substitute “22D”.I322I48416In section 157(2)(a) (maximum amount of penalty), for “49,” substitute “50B, 50C,”.
Omit Article 45 (transfers on the basis of an adequacy decision).I270I4534After that Article insert—
I306I4545 Transfers approved by regulations: monitoring¶
After Article 45B (inserted by paragraph 4) insert—
I390I4556 Transfers subject to appropriate safeguards¶
1Article 46 (transfers subject to appropriate safeguards) is amended as follows.2Omit paragraph 1.3After that paragraph insert—4In paragraph 2—ain the words before point (a)—iomit “appropriate”, andiifor “paragraph 1” substitute “paragraph 1A(a)”,bin point (a), for “public authorities or bodies” substitute “a public body and another relevant person or persons”,cin point (b), after “rules” insert “approved”,din point (c), for “section 17C of the 2018 Act” substitute “Article 47A(1)”,ein point (e), for “appropriate safeguards” substitute “safeguards provided by the code”, andfin point (f), for “appropriate safeguards” substitute “safeguards provided by the mechanism”.5In paragraph 3, in the words before point (a)—aomit “appropriate”,bfor “paragraph 1” substitute “paragraph 1A(a)”,comit “, in particular,”, anddin point (b), for “public authorities or bodies” substitute “a public body and another relevant person or persons”.6At the end insert—I354I4567In the heading of Article 47 (binding corporate rules) at the beginning insert “Transfers subject to appropriate safeguards:”.I190I4578After Article 47 insert—
1Article 49 (derogations for specific situations) is amended as follows.2In paragraph 1, in the first subparagraph—afor “adequacy regulations under section 17A of the 2018 Act, or of appropriate safeguards pursuant to Article 46, including binding corporate rules” substitute “approval by regulations under Article 45A and of compliance with Article 46 (appropriate safeguards)”, andbin point (a), for “an adequacy decision” substitute “approval by regulations under Article 45A”.3In paragraph 1, in the second subparagraph, for “a provision in Article 45” substitute “Article 45A”.4In paragraph 4, for “section 18(1) of the 2018 Act” substitute “paragraph 4A”.5After paragraph 4 insert—6Omit paragraph 5A.7After paragraph 6 insert—
In section 72 (overview and interpretation), in subsection (1)(b)—afor “the special conditions that apply” substitute “additional conditions that apply in certain cases”, andbafter “organisation” insert “(see section 73(4)(b))”.
1Section 73 (general principles for transfers) is amended as follows.2Before subsection (1) insert—3In subsection (1)—afor the words before paragraph (a) substitute “The controller in relation to the transfer must secure that the transfer takes place only if—”,bomit the “and” at the end of paragraph (a), andcafter paragraph (b) insert 4For subsection (3) substitute—5In subsection (4)—aafter paragraph (a) (but before the “or” at the end of that paragraph) insert—
, and
bin paragraph (b)(i), for “other than a relevant authority” substitute “who is not a person described in paragraph (a) or (aa)”.6In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.
1Omit section 74A (transfers based on adequacy regulations).2After that section insert—
I329I4885 Transfers approved by regulations: monitoring¶
1Section 74B (transfers based on adequacy regulations: review etc) is amended as follows.2For the heading substitute “Transfers approved by regulations: monitoring”.3Omit subsections (1) and (2).4In subsection (3), for “under section 74A” substitute “giving approval under section 74AA”.5In subsection (4), for the words from the beginning to “otherwise,” substitute “Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,”.6In subsection (5)—afor “section 74A” substitute “section 74AA”, andbfor “remedying the lack of an adequate level of protection” substitute “improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation”.7In subsection (6)(a)—aomit “, territories and specified sectors within a third country”,bomit “, territories, sectors”, andcfor “specified in regulations under section 74A” substitute “approved by regulations under section 74AA as places or persons to which personal data may be transferred”.8In subsection (6)(b)—aomit “, territories and specified sectors within a third country”,bomit “, territories, sectors”, andcfor “specified in” substitute “approved by”.9In subsection (7)—afor “regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer” substitute “regulations under section 74AA which approve only certain transfers to a third country or international organisation that are”,bafter “the regulations” insert “(in accordance with section 74AA(4)(b))”, andcomit paragraph (a) (together with the final “and”).
I260I4896 Transfers subject to appropriate safeguards¶
1Section 75 (transfers on the basis of appropriate safeguards) is amended as follows.2In the heading, for “on the basis of” substitute “subject to”.3Omit subsection (1).4After that subsection insert—5In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”.6In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”.7At the end insert—
I407I4907 Transfers based on special circumstances¶
1Section 76 (transfers on the basis of special circumstances) is amended as follows.2In the heading, for “on the basis of” substitute “based on”.3Before subsection (1) insert—4In subsection (1)—afor the words before paragraph (a) substitute “A transfer of personal data is necessary for a special purpose if it is necessary—”,bin paragraph (c)—iafter “public security” insert “or national security”, andiiat the end insert “or the United Kingdom”,cin paragraph (d), for “in individual cases” substitute “in particular circumstances,”, anddin paragraph (e), for “in individual cases” substitute “in particular circumstances,”.5In subsection (2), for “But subsection (1)(d) and (e) do not apply” substitute “But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)”.6After subsection (2) insert—7In subsection (3), for “subsection (1)” substitute “this section”.
For the italic heading before section 77 substitute “Additional conditions”.I197I49291Section 77 (conditions for transfers of personal data to persons other than relevant authorities) is amended as follows.2For the heading substitute “Additional conditions for transfers in reliance on section 73(4)(b)”.3In subsection (6), for “other than a relevant authority” substitute “in reliance on section 73(4)(b)”.4In subsection (7)(a), for “other than a relevant authority” substitute “that takes place in reliance on section 73(4)(b)”.
1Section 78 (subsequent transfers) is amended as follows.2Before subsection (1) insert—3In subsection (1)—aomit “Where personal data is transferred in accordance with section 73,”,bafter “transfer” insert
,
cfor “the data” substitute “the personal data”, anddat the end insert “(the 4After subsection (1) insert—5In subsection (2)—afor “A competent authority” substitute “The UK authoriser”, andbfor “under subsection (1)” substitute “for the purposes of a condition described in subsection (1)”.6In subsection (3), for “competent authority” substitute “UK authoriser”.7In subsection (4), for “an authorisation may not be given under subsection (1)” substitute “the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)”.8In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.9In subsection (6)—aafter “made” insert “in a case described in subsection (4)”,bfor “subsection (4)” substitute “that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform”, andcomit “must be informed without delay”.10At the end insert—
The UK GDPR is amended as follows.I36I4602In Article 13(1)(f) (information to be provided where personal data is collected from the data subject)—afor “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, andbfor “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.I89I4613In Article 14(1)(f) (information to be provided where personal data is not obtained from the data subject)—afor “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, andbfor “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.I399I4624In Article 15(2) (right of access by the data subject)—aafter “organisation” insert “in reliance on Article 46”, andbfor “appropriate safeguards pursuant to Article 46 relating to” substitute “safeguards provided in accordance with Article 46(1A)(a)(i) or (b)(i) for the purposes of”.I151I46351Article 40 (codes of conduct) is amended as follows.2In paragraph 3 omit “appropriate” in both places.3In paragraph 5, for “provides sufficient appropriate safeguards” substitute “is capable of providing safeguards for the purposes of Article 46”.I321I4646In Article 42(2) (certification) omit “appropriate” in both places.I286I4657In Article 46(2)(d) (transfers subject to appropriate safeguards: standard data protection clauses), after “Commissioner” insert “for the purposes of this Article”.I373I4668In Article 57(1) (Commissioner’s tasks)—ain point (m) omit “which provide sufficient safeguards,”, andbafter point (s) insert—
.
I177I4679In Article 58(3) (authorisation and advisory powers of the Commissioner), after point (j) insert—
.
I141I46810In Article 83(5)(c) (general conditions for imposing administrative fines), for “44” substitute “44A”.
The 2018 Act is amended as follows.I358I49412Omit section 17A (transfers based on adequacy regulations) and the italic heading before it.I186I49513Omit section 17B (transfers based on adequacy regulations: review etc).I293I49614Omit section 17C (standard data protection clauses).I211I49715Omit section 18 (transfers of personal data to third countries etc: public interest).I359I49816In section 24(2) (manual unstructured data held by FOI public authorities)—ain paragraph (c), for “44 to 49” substitute “44A to 49A”, andbomit paragraph (ca).I107I49917In section 26(2) (national security and defence exemption), omit paragraph (fa).I19I50018In section 75 (transfers on the basis of appropriate safeguards), after subsection (7) (inserted by Schedule 8 to this Act) insert—I146I50119In section 78A (law enforcement processing: national security exemption) (inserted by section 88 of this Act), in subsection (2)(e), after sub-paragraph (i) insert—
.
I332I502201Section 119A (power of Commissioner to specify standard clauses for transfers to third countries etc providing appropriate safeguards) is amended as follows.2In subsection (1), for the words from “provide” to the end substitute “are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data”.3In subsection (3), after paragraph (a) insert—
.
I109I50321In section 149(2)(e) (enforcement notices), for “44 to 49” substitute “44A to 49A”.I121I504221Section 182 (regulations and consultation) is amended as follows.2Omit subsection (4).3In subsection (6), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”.4In subsection (7), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”.5In subsection (8)—afor “Where regulations under this Act” substitute “For the purposes of this Act, regulations”,bafter “procedure”” insert “if”,cin paragraph (a), for “the urgency” substitute “an urgency”, anddin paragraph (b), for “the period of 120 days” substitute “a period”.6Omit subsections (9) and (10).7In subsection (11), after “by regulations” insert “made under this Act or another enactment that are”.8For subsection (14) substitute—I110I50523In section 205(2)(e) (references to periods of time) omit “and (9)”.I240I50624In paragraph 26(9)(d) of Schedule 2 (exemptions etc for journalistic, academic, artistic and literary purposes), for “44” substitute “44A”.I218I507251Part 3 of Schedule 21 (further transitional provision etc: transfers to third countries and international organisations) is amended as follows.2In the heading before paragraph 4, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.3In paragraph 4 (UK GDPR: adequacy decisions and adequacy regulations)—ain sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under Article 45A of the UK GDPR”,bin sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, andcomit sub-paragraph (6).4In paragraph 6 (UK GDPR: application of certain provisions referring to regulations made under section 17A of the 2018 Act)—ain sub-paragraph (1)(a), for “section 17A” substitute “Article 45A of the UK GDPR”,bfor sub-paragraph (2) substitute—
, and
cafter that sub-paragraph insert—5Omit paragraphs 7 and 8 (UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses).6In paragraph 9 (UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules)—ain sub-paragraph (1)—ifor “The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for” substitute “The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied”, andiiafter “described” insert “in”,bin sub-paragraph (3)(a)—ifor “or provision” substitute “, of provision”, andiifor “(or both)” substitute “or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025”, andcin sub-paragraph (4), after paragraph (a) insert—
.
7In the heading before paragraph 10, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.8In paragraph 10 (law enforcement processing: adequacy decisions and adequacy regulations)—ain sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under section 74AA”,bin sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, andcomit sub-paragraph (6).9In paragraph 12 (Part 3 (law enforcement processing): application of certain provisions referring to regulations made under section 74A)—athe existing text becomes sub-paragraph (1),bin that sub-paragraph—ifor the words before paragraph (a) substitute “In sections 74B and 76(A1)—”, andiiin paragraph (a), for “74A” substitute “74AA”, andcafter that sub-paragraph insert—
I327I53826 The UK GDPR: transfers approved by regulations¶
1Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule 7 to this Act).2In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 7 to this Act comes into force.
I384I53927 The UK GDPR: transfers subject to appropriate safeguards¶
1For the purposes of Article 44A(1)(a) and (2)(b) of the UK GDPR (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is made subject to appropriate safeguards where—athe transfer is made under arrangements entered into before the relevant day,bsafeguards are provided in accordance with paragraph 2 or 3 of Article 46 of the UK GDPR or paragraph 9 of Schedule 21 to the 2018 Act, andcif the transfer had been made immediately before the relevant day, it would have satisfied—ithe condition in Article 46(1) of the UK GDPR relating to data subjects’ rights and legal remedies, andiithe requirements of the last sentence of Article 44 of the UK GDPR (level of protection must not be undermined).2Sub-paragraph (1) has effect in addition to Article 46(1A) of the UK GDPR.3In this paragraph—
“international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);
“personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);
“the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force;
“third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).
I34I54028 The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses¶
1Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule 7 to this Act).2In this paragraph, “the relevant day” means the day on which paragraph 8 of Schedule 7 to this Act comes into force.I263I541291This paragraph applies to a requirement for safeguards to be provided under—aArticle 46(1A)(a)(i) of the UK GDPR, orbparagraph 27(1)(b) of this Schedule.2The requirement may be satisfied on and after the relevant day by a version of pre-commencement standard clauses incorporating changes where—aall of the changes are made in consequence of the amendment of Chapter 5 of the UK GDPR by this Act, andbnone of the changes alters the effect of the clauses.3Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph (2).4Sub-paragraphs (2) and (3) cease to apply in relation to pre-commencement standard clauses if—athe clauses are specified in regulations and a provision of the regulations relating to the clauses is amended or revoked on or after the relevant day, orbthe clauses are specified in another document and a provision of the document relating to the clauses is amended or withdrawn by the Information Commissioner on or after the relevant day.5Sub-paragraph (2) has effect in addition to Article 46(2) and (3) of the UK GDPR.6In this paragraph—
“pre-commencement standard clauses” means standard data protection clauses specified in—
regulations made under section 17C of the 2018 Act and in force immediately before the relevant day, or
a document issued by the Information Commissioner under section 119A of the 2018 Act before the relevant day and not withdrawn before that day;
“the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force.
I196I54230 The UK GDPR: transfers necessary for important reasons of public interest¶
1Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by Schedule 7 to this Act).2In this paragraph, “the relevant day” means the day on which paragraph 9(5) of Schedule 7 to this Act comes into force.
I296I54331 The UK GDPR: restrictions on transfers of personal data to third countries and international organisations¶
1Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule 7 to this Act).2In this paragraph, “the relevant day” means the day on which paragraph 10 of Schedule 7 to this Act comes into force.
I204I54432 Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations¶
1Regulations made under section 74A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under section 74AA of that Act (inserted by Schedule 8 to this Act).2In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 8 to this Act comes into force.
I245I54533 Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards¶
1For the purposes of section 73(3) of the 2018 Act (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is a transfer made subject to appropriate safeguards where—aan appropriate pre-commencement legal instrument binds the intended recipient of the data, andbif the transfer had been made immediately before the relevant day, the requirement in section 75(1)(a) of the 2018 Act (binding legal instrument containing appropriate safeguards) would have been satisfied by virtue of that instrument.2Sub-paragraph (1) has effect in addition to section 75(1A) of the 2018 Act.3For the purposes of sub-paragraph (1), a legal instrument is an “appropriate pre-commencement legal instrument”, in relation to a transfer of personal data, if—ait was entered into before the relevant day,bit is intended to be relied on in connection with the transfer or that type of transfer, andcat least one competent authority is a party to the instrument.4In this paragraph—
“competent authority” has the same meaning as in Part 3 of the 2018 Act (see section 30 of that Act);
“international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);
“personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);
“the relevant day” means the day on which paragraph 6 of Schedule 8 to this Act comes into force;
“third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).
I2581The UK GDPR is amended as follows.I152In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”.I12931Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows.2After point (c) insert—
.
3In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.I1441Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows.2After point (d) insert—
.
3In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.I551Article 15(1) (right of access by the data subject) is amended as follows.2After point (e) insert—
.
3In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.I476In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”.I28871Article 80 (representation of data subjects) is amended as follows.2In paragraph 1—afor “lodge the complaint” substitute “make a complaint under section 164A or 165 of the 2018 Act”, andbomit “77,”.3In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”.
I2978The 2018 Act is amended as follows.I2269In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act).I115101Section 44 (information: controller’s general duties) is amended as follows.2In subsection (1)—aafter paragraph (d) insert—
, and
bin paragraph (e), after “Commissioner”, in the first place it occurs, insert “(see section 165)”.3In subsection (5)—aafter paragraph (c) insert—
, and
bin paragraph (d), after “Commissioner” insert “under section 165”.I338111Section 45 (right of access by the data subject) is amended as follows.2In subsection (2)—aafter paragraph (e) insert—
, and
bin paragraph (f), after “the Commissioner”, in the first place it occurs, insert “(see section 165)”.3In subsection (5)—aafter paragraph (c) insert—
, and
bin paragraph (d), at the end insert “under section 165”.I14412In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section 79 of this Act), in subsection (2), after paragraph (c) insert—
.
I101131Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows.2In subsection (1)(b)—aafter sub-paragraph (ii) insert—
, and
bin sub-paragraph (iii), after “Commissioner” insert “under section 165”.3In subsection (4)—aafter paragraph (b) insert—
, and
bin paragraph (c), after “Commissioner” insert “under section 165”.I32014In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”.I3915In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”.I305161Section 149 (enforcement notices) is amended as follows.2In subsection (1), for “or (5)” substitute “, (5) or (5A)”.3After subsection (5) insert—4In subsection (6), for “or (5)” substitute “, (5) or (5A)”.I35717In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”.I26418In section 157 (maximum amount of penalty), after subsection (4) insert—I1219In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”.I257201Section 166 (orders to progress complaints) is amended as follows.2In the heading, at the end insert “to the Commissioner”.3In subsection (1), omit “or Article 77 of the UK GDPR”.I401211Section 187 (representation of data subjects with their authority) is amended as follows.2In subsection (1)(a)—afor “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles”, andbomit “to lodge complaints and”.3In subsection (2)—abefore paragraph (a) insert—
, and
bin paragraph (a), for “165(2) and (4)(d)” substitute “165”.
I143I2011The UK GDPR is amended as follows.I111I22121Article 4(1) (interpretation) is amended as follows.2After point (15) insert—
.
3After point (28) insert—I382I1823After Article 4 insert—I247I74In Article 9 (processing of special categories of personal data)—ain paragraph 2, after “apply if” insert “the processing is based on Article 6(1) and”,bin paragraph 2(f), after “courts” insert “or tribunals”, andcin paragraph 3, for the words from the beginning to “data are” substitute “Paragraph 1 is only disapplied by point (h) of paragraph 2 if the personal data is”.I268I3965In Article 12(5) (information etc to be provided free of charge), at the beginning insert “Subject to Article 15(3),”.I10I2836In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)”.I181I977In Article 24(3) (responsibility of the controller), for “an element by which to demonstrate” substitute “a means of demonstrating”.I175I1428In Article 25(3) (data protection by design and by default), for “an element to demonstrate” substitute “a means of demonstrating”.I216I2759In Article 28(5) (processors), for “an element by which to demonstrate” substitute “a means of demonstrating”.I195I9910In Article 32(3) (security of processing), for “an element by which to demonstrate” substitute “a means of demonstrating”.I78I28711In Article 37(1)(a), after “courts” insert “and tribunals”.I93I25512Omit Article 59 (activity reports).
The 2018 Act is amended as follows.I398I28514In section 3(9) (definition of “the data protection legislation”)—ainsert “and” at the end of paragraph (c), andbomit paragraph (e) (regulations under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive) and the “and” before it.I134I34915Omit section 20 (meaning of “court” in Part 2).I24I36316In section 94 (data subject’s right of access under Part 4), in subsection (10), for “subsection (6)” substitute “subsections (3), (5) and (6)”.I323I26217In section 119A(11) (standard clauses for transfers to third countries etc), after “any” insert “whole days that fall within a”.I127I16018In section 124(5) (data protection and journalism code), in the definition of “good practice in the processing of personal data for the purposes of journalism”—ain paragraph (a), omit “, including compliance with the requirements of the data protection legislation”, andbafter paragraph (b) insert—
.
I123I278191Section 125 (approval of codes of practice prepared by the Commissioner) is amended as follows.2Omit subsection (2).3In subsection (8), after “any” insert “whole days that fall within a”.4In subsection (9), for “subsections (2) and (5)” substitute “subsection (5)”.I57I38720In section 139 (reporting to Parliament), omit subsection (2).I316I37121In section 161(6) (approval of first guidance about regulatory action), after “any” insert “whole days that fall within a”.I147I50822In section 170(2)(a) (unlawful obtaining etc of personal data), after “preventing” insert “, investigating”.I51I509231Section 171 (re-identification of de-identified personal data) is amended as follows.2In subsection (3)(a), after “preventing” insert “, investigating”.3In subsection (6)(a), after “preventing” insert “, investigating”.I223I13724In section 181 (interpretation of Part 6) omit the definition of “representative”.I386I51025In section 184(4) (prohibition of requirement to produce relevant records), after “prevention” insert “, investigation”.I249I23126In section 192(6) (approval of the Framework), after “any” insert “whole days that fall within a”.I48I8227In section 206 (index of defined expressions), in the Table, omit the entry for “representative (in Part 6)”.I234I511281Schedule 1 (special categories of personal data and criminal convictions etc data) is amended as follows.2In the heading before paragraph 10, for “or detecting” substitute “etc”.3In paragraph 10(1)(a) (preventing etc unlawful acts), after “prevention” insert “, investigation”.4In paragraph 13(1)(a) (journalism etc in connection with unlawful acts and dishonesty etc), after “consists of” insert “, or is carried out in preparation for,”.5In paragraph 14(1)(b) (preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—
.
6In paragraph 24(1)(a) (disclosure to elected representatives), after “consists of” insert “, or is carried out in preparation for,”.I356I512291Schedule 2 (exemptions etc from the UK GDPR) is amended as follows.2In paragraph 2(1)(a) (crime), after “prevention” insert “, investigation”.3In paragraph 3(2)(b)(ii) (crime: risk assessment systems), after “prevention” insert “, investigation”.I16I51330In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing under Part 3: preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—
.
I424I46931In paragraph 2(a) of Schedule 11 (other exemptions under Part 4: crime), after “prevention” insert “, investigation”.
The following provisions (inserted by section 31 of the Victims and Prisoners Act 2024) extend to Scotland and Northern Ireland (as well as to England and Wales)—aArticle 17(1)(g), (4) and (5) of the UK GDPR (right to erasure), andbsection 13A of the 2018 Act (meaning of “relevant offence” for purpose of right to erasure).
1This paragraph applies to the person who holds the office of Information Commissioner immediately before the day on which this Schedule comes into force.2The person is to be treated as having been appointed as the chair of the Information Commission for a term that expires at the time the person would cease to hold the office of Information Commissioner but for the abolition of that office by section 118.3For the purposes of paragraph 7(3) of Schedule 12A to the Data Protection Act 2018 (extension of chair’s term), the term of the person’s appointment as chair of the Information Commission is to be treated as a term beginning when the person began to hold the office of Information Commissioner.
I38I2273 Transitional provision: consultation about non-executive members¶
1This paragraph is about the requirement under paragraph 3(4) of Schedule 12A to the Data Protection Act 2018 for the Secretary of State to consult the chair of the Information Commission before appointing a non-executive member of the Information Commission.2The requirement may be satisfied by consultation, before this Schedule comes into force, with the person who holds the office of Information Commissioner.
I163I904 Transitional provision: consultation about interim chief executive¶
1This paragraph is about the requirement under paragraph 25 of Schedule 12A to the Data Protection Act 2018 (transitional provision: interim chief executive) for the chair of the Information Commission to consult the Secretary of State before appointing the first chief executive of the Information Commission.2The requirement may be satisfied by consultation carried out, before this Schedule comes into force, by the person who holds the office of Information Commissioner.
Information standards for health and adult social care in England
Section 121
I44I5461Chapter 1 of Part 9 of the Health and Social Care Act 2012 (health and adult social care services: information standards) is amended as follows.I133I5222Before section 250 insert—
.
I1I52331Section 250 (powers to publish information standards) is amended as follows.2In subsection (2), at the end insert “and includes, among other things, a standard relating to information technology or IT services used, or intended to be used, in connection with the processing of information (see section 250A)”.3In subsection (2B)(c)—aafter “provision” insert “in, or in relation to, England”, andbomit “in England”.4In subsection (2B), at the end insert—5In subsection (3)—aafter “provision” insert “in, or in relation to, England”, andbomit “in England”.6In subsection (7)—ain the opening words, for “section” substitute “Chapter”,bafter the definition of “health care” insert—
,
cin the definition of “processing”, omit “and (14)”, anddat the end insert—I140I5244After section 250 insert—I169I52551Section 251 (information standards: procedure etc) is amended as follows.2In the heading omit “Information standards:”.3For subsection (3) substitute—I187I5266After section 251 insert—
.
I18I5277For the heading of section 251ZA (information standards: compliance) substitute “Monitoring compliance”.I348I5288After that section insert—
I1611The Energy Act 2008 is amended as follows.I1192In the italic heading before section 88, after “meters” insert “: modification of licence conditions etc by Secretary of State”.I83After section 91 insert—I884In section 104 (subordinate legislation)—ain subsection (1), for “or the Scottish Ministers” substitute “, the Scottish Ministers or the Gas and Electricity Markets Authority”;bin subsection (3), at the end insert
1The Gas Act 1986 is amended as follows.2In section 7B (licences: general)—aomit subsection (2B);bin subsection (2C), after “for” insert “a smart meter communication licence or”.3In section 41HC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a smart meter communication licence,”.
1The Electricity Act 1989 is amended as follows.2In section 6A (procedure for licence applications)—ain subsection (1)(a), for “subsections (1A) and (1B)” substitute “subsection (1B)”;bomit subsection (1A);cin subsection (1B), after “for” insert “a smart meter communication licence or”.3In section 56FC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a licence under section 6(1)(f) (smart meter communication licence),”.
I1797 Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012¶
The Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012 (S.I. 2012/2414) are revoked.
Footnotes
I1
Sch. 15 para. 3 not in force at Royal Assent, see s. 142(1)
I2
S. 3 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I3
S. 25 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I4
S. 90 in force at 17.11.2025 by S.I. 2025/996, reg. 2(2)(b)
I5
Sch. 10 para. 5 not in force at Royal Assent, see s. 142(1)
I6
S. 71 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I7
Sch. 11 para. 4 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I8
Sch. 16 para. 3 in force at Royal Assent, see s. 142(2)(c)
I9
S. 64 not in force at Royal Assent, see s. 142(1)
I10
Sch. 11 para. 6 not in force at Royal Assent, see s. 142(1)
I11
Sch. 9 para. 11 not in force at Royal Assent, see s. 142(1)
I12
Sch. 10 para. 19 not in force at Royal Assent, see s. 142(1)
I13
Sch. 3 para. 24 not in force at Royal Assent, see s. 142(1)
I14
Sch. 10 para. 4 not in force at Royal Assent, see s. 142(1)
I15
Sch. 10 para. 2 not in force at Royal Assent, see s. 142(1)
I16
Sch. 11 para. 30 not in force at Royal Assent, see s. 142(1)
I17
S. 130 not in force at Royal Assent, see s. 142(1)
I18
Sch. 15 para. 7 not in force at Royal Assent, see s. 142(1)
I19
Sch. 9 para. 18 not in force at Royal Assent, see s. 142(1)
I20
S. 36 not in force at Royal Assent, see s. 142(1)
I21
S. 134 in force at 20.8.2025 by S.I. 2025/904, reg. 2(u)
I22
Sch. 9 para. 1 not in force at Royal Assent, see s. 142(1)
I23
S. 128 in force at Royal Assent, see s. 142(2)(f)
I24
Sch. 11 para. 16 not in force at Royal Assent, see s. 142(1)
I25
S. 125 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I26
S. 89 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I27
Sch. 3 para. 7 not in force at Royal Assent, see s. 142(1)
I28
S. 65 not in force at Royal Assent, see s. 142(1)
I29
S. 62 not in force at Royal Assent, see s. 142(1)
I30
Sch. 7 para. 10 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I31
S. 53 not in force at Royal Assent, see s. 142(1)
I32
Sch. 8 para. 3 not in force at Royal Assent, see s. 142(1)
I33
Sch. 3 para. 11 not in force at Royal Assent, see s. 142(1)
I34
Sch. 9 para. 28 not in force at Royal Assent, see s. 142(1)
I35
S. 4 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I36
Sch. 9 para. 2 not in force at Royal Assent, see s. 142(1)
I37
Sch. 7 para. 9 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I38
Sch. 14 para. 3 not in force at Royal Assent, see s. 142(1)
I39
Sch. 10 para. 15 not in force at Royal Assent, see s. 142(1)
I40
Sch. 3 para. 23 not in force at Royal Assent, see s. 142(1)
I41
S. 55 in force at 1.12.2025 in so far as not already in force by S.I. 2025/1213, reg. 2
I42
S. 124 in force at 30.9.2025 in so far as not already in force by S.I. 2025/982, reg. 2
I43
S. 107 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(l)
I44
Sch. 15 para. 1 not in force at Royal Assent, see s. 142(1)
I45
S. 73 not in force at Royal Assent, see s. 142(1)
I46
Sch. 7 para. 3 not in force at Royal Assent, see s. 142(1)
I47
Sch. 10 para. 6 not in force at Royal Assent, see s. 142(1)
I48
Sch. 11 para. 27 not in force at Royal Assent, see s. 142(1)
I49
S. 33 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I50
S. 80 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I51
Sch. 11 para. 23 not in force at Royal Assent, see s. 142(1)
I52
Sch. 8 para. 2 not in force at Royal Assent, see s. 142(1)
I53
S. 57 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I54
S. 125 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(s)
I55
S. 107 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I56
S. 23 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I57
Sch. 11 para. 20 not in force at Royal Assent, see s. 142(1)
I58
S. 95 not in force at Royal Assent, see s. 142(1)
I59
Sch. 6 para. 12 not in force at Royal Assent, see s. 142(1)
I60
S. 11 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I61
S. 46 not in force at Royal Assent, see s. 142(1)
I62
S. 8 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I63
S. 90 not in force at Royal Assent, see s. 142(1)
I64
Sch. 8 para. 1 not in force at Royal Assent, see s. 142(1)
I65
S. 75 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I66
S. 12 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I67
Sch. 8 para. 4 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I68
S. 21 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I69
S. 106 not in force at Royal Assent, see s. 142(1)
I70
Sch. 6 para. 3 not in force at Royal Assent, see s. 142(1)
I71
S. 39 in force at 1.12.2025 in so far as not already in force by S.I. 2025/1213, reg. 2
I72
S. 132 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I73
S. 35 not in force at Royal Assent, see s. 142(1)
I74
S. 35 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I75
S. 94 not in force at Royal Assent, see s. 142(1)
I76
S. 93 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I77
S. 51 not in force at Royal Assent, see s. 142(1)
I78
Sch. 11 para. 11 not in force at Royal Assent, see s. 142(1)
I79
Sch. 6 para. 2 not in force at Royal Assent, see s. 142(1)
I80
S. 38 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I81
S. 41 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I82
Sch. 11 para. 27 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I83
S. 1 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I84
S. 39 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I85
S. 101 not in force at Royal Assent, see s. 142(1)
I86
S. 79 in force at 5.9.2025 by S.I. 2025/996, reg. 2(1)(a) (with reg. 3)
I87
S. 1 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I88
Sch. 16 para. 4 in force at Royal Assent, see s. 142(2)(c)
I89
Sch. 9 para. 3 not in force at Royal Assent, see s. 142(1)
I90
Sch. 14 para. 4 in force at 20.8.2025 by S.I. 2025/904, reg. 2(z)
I91
S. 33 not in force at Royal Assent, see s. 142(1)
I92
Sch. 16 para. 6 not in force at Royal Assent, see s. 142(4)
I93
Sch. 11 para. 12 not in force at Royal Assent, see s. 142(1)
I94
S. 2 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I95
Sch. 3 para. 4 not in force at Royal Assent, see s. 142(1)
I96
Sch. 3 para. 22 not in force at Royal Assent, see s. 142(1)
I97
Sch. 11 para. 7 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I98
S. 10 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I99
Sch. 11 para. 10 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I100
S. 108 in force at 20.8.2025 by S.I. 2025/904, reg. 2(m)
I101
Sch. 10 para. 13 not in force at Royal Assent, see s. 142(1)
I102
Sch. 1 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I103
S. 88 not in force at Royal Assent, see s. 142(1)
I104
S. 58 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I105
S. 49 not in force at Royal Assent, see s. 142(1)
I106
S. 51 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I107
Sch. 9 para. 17 not in force at Royal Assent, see s. 142(1)
I108
S. 105 not in force at Royal Assent, see s. 142(1)
I109
Sch. 9 para. 21 not in force at Royal Assent, see s. 142(1)
I110
Sch. 9 para. 23 not in force at Royal Assent, see s. 142(1)
I111
Sch. 11 para. 2 not in force at Royal Assent, see s. 142(1)
I112
S. 40 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I113
S. 135 not in force at Royal Assent, see s. 142(1)
I114
S. 102 in force at 20.8.2025 by S.I. 2025/904, reg. 2(i)
I115
Sch. 10 para. 10 not in force at Royal Assent, see s. 142(1)
I116
Sch. 3 para. 27 not in force at Royal Assent, see s. 142(1)
I117
S. 18 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I118
S. 40 not in force at Royal Assent, see s. 142(1)
I119
Sch. 16 para. 2 in force at Royal Assent, see s. 142(2)(c)
I120
S. 72(7) in force at 20.8.2025 for specified purposes by S.I. 2025/904, reg. 2(b)
I121
Sch. 9 para. 22 not in force at Royal Assent, see s. 142(1)
I122
Sch. 3 para. 20 not in force at Royal Assent, see s. 142(1)
I123
Sch. 11 para. 19 not in force at Royal Assent, see s. 142(1)
I124
S. 7 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I125
Sch. 6 para. 9 not in force at Royal Assent, see s. 142(1)
I126
S. 67 not in force at Royal Assent, see s. 142(1)
I127
Sch. 11 para. 18 not in force at Royal Assent, see s. 142(1)
I128
S. 87 not in force at Royal Assent, see s. 142(1)
I129
Sch. 10 para. 3 not in force at Royal Assent, see s. 142(1)
I130
Sch. 14 para. 2 not in force at Royal Assent, see s. 142(1)
I131
S. 72(1)(2)(4)-(6)(8) in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(b)
I132
Sch. 14 para. 2 in force at 20.8.2025 by S.I. 2025/904, reg. 2(z)
I133
Sch. 15 para. 2 not in force at Royal Assent, see s. 142(1)
I134
Sch. 11 para. 15 not in force at Royal Assent, see s. 142(1)
I135
S. 106 in force at 20.8.2025 by S.I. 2025/904, reg. 2(k)
I136
Sch. 3 para. 12 not in force at Royal Assent, see s. 142(1)
I137
Sch. 11 para. 24 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I138
S. 20 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I139
S. 104 not in force at Royal Assent, see s. 142(1)
I140
Sch. 15 para. 4 not in force at Royal Assent, see s. 142(1)
I141
Sch. 9 para. 10 not in force at Royal Assent, see s. 142(1)
I142
Sch. 11 para. 8 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I143
Sch. 11 para. 1 not in force at Royal Assent, see s. 142(1)
I144
Sch. 10 para. 12 not in force at Royal Assent, see s. 142(1)
I145
S. 50 not in force at Royal Assent, see s. 142(1)
I146
Sch. 9 para. 19 not in force at Royal Assent, see s. 142(1)
I147
Sch. 11 para. 22 not in force at Royal Assent, see s. 142(1)
I148
S. 17 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I149
Sch. 2 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I150
S. 111 in force at 20.8.2025 by S.I. 2025/904, reg. 2(p)
I151
Sch. 9 para. 5 not in force at Royal Assent, see s. 142(1)
I152
S. 34 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I153
S. 8 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I154
S. 111 not in force at Royal Assent, see s. 142(1)
I155
S. 74 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(c)
I156
S. 84 not in force at Royal Assent, see s. 142(1)
I157
S. 100 not in force at Royal Assent, see s. 142(1)
I158
S. 15 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I159
S. 140 in force at Royal Assent, see s. 142(2)(g)
I160
Sch. 11 para. 18 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I161
Sch. 16 para. 1 in force at Royal Assent, see s. 142(2)(c)
I162
Sch. 3 para. 16 not in force at Royal Assent, see s. 142(1)
I163
Sch. 14 para. 4 not in force at Royal Assent, see s. 142(1)
I164
S. 110(1)(2)(c)(4)(5) in force at 20.8.2025 by S.I. 2025/904, reg. 2(o)
I165
S. 21 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I166
S. 25 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I167
S. 98 not in force at Royal Assent, see s. 142(1)
I168
S. 92 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I169
Sch. 15 para. 5 not in force at Royal Assent, see s. 142(1)
I170
Sch. 3 para. 13 not in force at Royal Assent, see s. 142(1)
I171
Sch. 6 para. 13 not in force at Royal Assent, see s. 142(1)
I172
S. 13 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I173
S. 55 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I174
S. 69 in force at 19.8.2025, see s. 142(3)(a)
I175
Sch. 11 para. 8 not in force at Royal Assent, see s. 142(1)
I176
S. 127 in force at Royal Assent, see s. 142(2)(e)
I177
Sch. 9 para. 9 not in force at Royal Assent, see s. 142(1)
I178
S. 20 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I179
Sch. 16 para. 7 not in force at Royal Assent, see s. 142(4)
I180
Sch. 13 not in force at Royal Assent, see s. 142(1)
I181
Sch. 11 para. 7 not in force at Royal Assent, see s. 142(1)
I182
Sch. 11 para. 3 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I183
S. 141 in force at Royal Assent, see s. 142(2)(g)
I184
S. 41 not in force at Royal Assent, see s. 142(1)
I185
S. 78 in force at Royal Assent, see s. 142(2)(b)
I186
Sch. 9 para. 13 not in force at Royal Assent, see s. 142(1)
I187
Sch. 15 para. 6 not in force at Royal Assent, see s. 142(1)
I188
S. 52 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I189
Sch. 6 para. 1 not in force at Royal Assent, see s. 142(1)
I190
Sch. 7 para. 8 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I191
S. 137 in force at 20.8.2025 by S.I. 2025/904, reg. 2(x)
I192
S. 85 not in force at Royal Assent, see s. 142(1)
I193
S. 109 not in force at Royal Assent, see s. 142(1)
I194
S. 59 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I195
Sch. 11 para. 10 not in force at Royal Assent, see s. 142(1)
I196
Sch. 9 para. 30 not in force at Royal Assent, see s. 142(1)
I197
Sch. 8 para. 9 not in force at Royal Assent, see s. 142(1)
I198
S. 26 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I199
Sch. 3 para. 19 not in force at Royal Assent, see s. 142(1)
I200
S. 31 not in force at Royal Assent, see s. 142(1)
I201
Sch. 11 para. 1 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I202
S. 91 in force at 20.8.2025 by S.I. 2025/904, reg. 2(e)
I203
S. 120 not in force at Royal Assent, see s. 142(1)
I204
Sch. 9 para. 32 not in force at Royal Assent, see s. 142(1)
I205
S. 135 in force at 20.8.2025 by S.I. 2025/904, reg. 2(v)
I206
S. 68 not in force at Royal Assent, see s. 142(1)
I207
S. 14 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I208
S. 31 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I209
Sch. 4 not in force at Royal Assent, see s. 142(1)
I210
S. 144 in force at Royal Assent, see s. 142(2)(g)
I211
Sch. 9 para. 15 not in force at Royal Assent, see s. 142(1)
I212
S. 119 not in force at Royal Assent, see s. 142(1)
I213
S. 126 in force at Royal Assent, see s. 142(2)(d)
I214
Sch. 16 para. 5 not in force at Royal Assent, see s. 142(4)
I215
S. 66 in force at Royal Assent, see s. 142(2)(a)
I216
Sch. 11 para. 9 not in force at Royal Assent, see s. 142(1)
I217
Sch. 3 para. 14 not in force at Royal Assent, see s. 142(1)
I218
Sch. 9 para. 25 not in force at Royal Assent, see s. 142(1)
I219
Sch. 14 para. 1 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I220
S. 15 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I221
Sch. 11 para. 2 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I222
S. 19 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I223
Sch. 11 para. 24 not in force at Royal Assent, see s. 142(1)
I224
S. 47 not in force at Royal Assent, see s. 142(1)
I225
S. 86 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I226
Sch. 10 para. 9 not in force at Royal Assent, see s. 142(1)
I227
Sch. 14 para. 3 in force at 20.8.2025 by S.I. 2025/904, reg. 2(z)
I228
S. 26 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I229
S. 24 in force at 20.8.2025 by S.I. 2025/904, reg. 2(a)
I230
S. 92 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(f)
I231
Sch. 11 para. 26 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I232
Sch. 3 para. 28 not in force at Royal Assent, see s. 142(1)
I233
S. 12 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I234
Sch. 11 para. 28 not in force at Royal Assent, see s. 142(1)
I235
S. 131 not in force at Royal Assent, see s. 142(1)
I236
Sch. 12 not in force at Royal Assent, see s. 142(1)
I237
S. 76 not in force at Royal Assent, see s. 142(1)
I238
S. 29 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I239
S. 139 in force at Royal Assent, see s. 142(2)(g)
I240
Sch. 9 para. 24 not in force at Royal Assent, see s. 142(1)
I241
Sch. 11 para. 13 not in force at Royal Assent, see s. 142(1)
I242
S. 117 not in force at Royal Assent, see s. 142(1)
I243
S. 19 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I244
S. 84 in force at 20.8.2025 by S.I. 2025/904, reg. 2(d)
I245
Sch. 9 para. 33 not in force at Royal Assent, see s. 142(1)
I246
S. 103 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I247
Sch. 11 para. 4 not in force at Royal Assent, see s. 142(1)
I248
S. 142 in force at Royal Assent, see s. 142(2)(g)
I249
Sch. 11 para. 26 not in force at Royal Assent, see s. 142(1)
I250
Sch. 3 para. 9 not in force at Royal Assent, see s. 142(1)
I251
S. 27 not in force at Royal Assent, see s. 142(1)
I252
S. 104 in force at 20.8.2025 by S.I. 2025/904, reg. 2(j)
I253
S. 13 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I254
S. 5 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I255
Sch. 11 para. 12 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I256
S. 138 not in force at Royal Assent, see s. 142(1)
I257
Sch. 10 para. 20 not in force at Royal Assent, see s. 142(1)
I258
Sch. 10 para. 1 not in force at Royal Assent, see s. 142(1)
I259
S. 54 not in force at Royal Assent, see s. 142(1)
I260
Sch. 8 para. 6 not in force at Royal Assent, see s. 142(1)
I261
S. 133 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I262
Sch. 11 para. 17 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I263
Sch. 9 para. 29 not in force at Royal Assent, see s. 142(1)
I264
Sch. 10 para. 18 not in force at Royal Assent, see s. 142(1)
I265
S. 136 not in force at Royal Assent, see s. 142(1)
I266
S. 53 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I267
S. 6 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I268
Sch. 11 para. 5 not in force at Royal Assent, see s. 142(1)
I269
S. 5 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I270
Sch. 7 para. 4 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I271
S. 11 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I272
S. 108 not in force at Royal Assent, see s. 142(1)
I273
S. 4 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I274
Sch. 3 para. 17 not in force at Royal Assent, see s. 142(1)
I275
Sch. 11 para. 9 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I276
S. 97 in force at 19.8.2025, see s. 142(3)(d)
I277
Sch. 6 para. 6 not in force at Royal Assent, see s. 142(1)
I278
Sch. 11 para. 19 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I279
Sch. 3 para. 2 not in force at Royal Assent, see s. 142(1)
I280
Sch. 11 para. 32 not in force at Royal Assent, see s. 142(1)
I281
S. 110 not in force at Royal Assent, see s. 142(1)
I282
S. 7 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I283
Sch. 11 para. 6 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I284
S. 9 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I285
Sch. 11 para. 14 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I286
Sch. 9 para. 7 not in force at Royal Assent, see s. 142(1)
I287
Sch. 11 para. 11 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I288
Sch. 10 para. 7 not in force at Royal Assent, see s. 142(1)
I289
S. 44 not in force at Royal Assent, see s. 142(1)
I290
S. 3 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I291
S. 16 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I292
S. 118 not in force at Royal Assent, see s. 142(1)
I293
Sch. 9 para. 14 not in force at Royal Assent, see s. 142(1)
I294
S. 43 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I295
Sch. 11 para. 13 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I296
Sch. 9 para. 31 not in force at Royal Assent, see s. 142(1)
I297
Sch. 10 para. 8 not in force at Royal Assent, see s. 142(1)
I298
Sch. 3 para. 6 not in force at Royal Assent, see s. 142(1)
I299
S. 14 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I300
S. 95 in force at 20.8.2025 by S.I. 2025/904, reg. 2(h)
I301
S. 22 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I302
S. 50 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I303
S. 123 not in force at Royal Assent, see s. 142(1)
I304
S. 32 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I305
Sch. 10 para. 16 not in force at Royal Assent, see s. 142(1)
I306
Sch. 7 para. 5 not in force at Royal Assent, see s. 142(1)
I307
S. 34 not in force at Royal Assent, see s. 142(1)
I308
S. 30 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I309
S. 136 in force at 20.8.2025 by S.I. 2025/904, reg. 2(w)
I310
S. 81 not in force at Royal Assent, see s. 142(1)
I311
S. 9 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I312
S. 56 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I313
Sch. 3 para. 3 not in force at Royal Assent, see s. 142(1)
I314
S. 42 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I315
S. 16 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I316
Sch. 11 para. 21 not in force at Royal Assent, see s. 142(1)
I317
Sch. 5 not in force at Royal Assent, see s. 142(1)
I318
S. 83 not in force at Royal Assent, see s. 142(1)
I319
S. 10 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I320
Sch. 10 para. 14 not in force at Royal Assent, see s. 142(1)
I321
Sch. 9 para. 6 not in force at Royal Assent, see s. 142(1)
I322
Sch. 6 para. 16 not in force at Royal Assent, see s. 142(1)
I323
Sch. 11 para. 17 not in force at Royal Assent, see s. 142(1)
I324
Sch. 6 para. 7 not in force at Royal Assent, see s. 142(1)
I325
S. 17 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I326
S. 79 not in force at Royal Assent, see s. 142(1)
I327
Sch. 9 para. 26 not in force at Royal Assent, see s. 142(1)
I328
S. 137 not in force at Royal Assent, see s. 142(1)
I329
Sch. 8 para. 5 not in force at Royal Assent, see s. 142(1)
I330
S. 88 in force at 5.9.2025 by S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
I331
S. 74 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I332
Sch. 9 para. 20 not in force at Royal Assent, see s. 142(1)
I333
S. 48 not in force at Royal Assent, see s. 142(1)
I334
S. 124 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I335
Sch. 3 para. 8 not in force at Royal Assent, see s. 142(1)
I336
S. 38 not in force at Royal Assent, see s. 142(1)
I337
Sch. 3 para. 25 not in force at Royal Assent, see s. 142(1)
I338
Sch. 10 para. 11 not in force at Royal Assent, see s. 142(1)
I339
S. 114 not in force at Royal Assent, see s. 142(1)
I340
S. 28 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I341
S. 22 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I342
S. 63 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I343
Sch. 8 para. 10 not in force at Royal Assent, see s. 142(1)
I344
S. 60 not in force at Royal Assent, see s. 142(1)
I345
Sch. 3 para. 26 not in force at Royal Assent, see s. 142(1)
I346
S. 45 not in force at Royal Assent, see s. 142(1)
I347
Sch. 3 para. 1 not in force at Royal Assent, see s. 142(1)
I348
Sch. 15 para. 8 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I349
Sch. 11 para. 15 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I350
Sch. 6 para. 11 not in force at Royal Assent, see s. 142(1)
I351
S. 96 in force at 19.8.2025, see s. 142(3)(c)
I352
Sch. 14 para. 1 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(z) (with reg. 1(3))
I353
S. 6 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I354
Sch. 7 para. 7 not in force at Royal Assent, see s. 142(1)
I355
S. 49 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I356
Sch. 11 para. 29 not in force at Royal Assent, see s. 142(1)
I357
Sch. 10 para. 17 not in force at Royal Assent, see s. 142(1)
I358
Sch. 9 para. 12 not in force at Royal Assent, see s. 142(1)
I359
Sch. 9 para. 16 not in force at Royal Assent, see s. 142(1)
I360
S. 89 in force at 17.11.2025 in so far as not already in force by S.I. 2025/996, reg. 2(2)(a)
I361
Sch. 3 para. 15 not in force at Royal Assent, see s. 142(1)
I362
S. 27 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I363
Sch. 11 para. 16 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I364
S. 29 not in force at Royal Assent, see s. 142(1)
I365
Sch. 7 para. 1 not in force at Royal Assent, see s. 142(1)
I366
Sch. 6 para. 5 not in force at Royal Assent, see s. 142(1)
I367
S. 37 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I368
S. 116 not in force at Royal Assent, see s. 142(1)
I369
S. 28 not in force at Royal Assent, see s. 142(1)
I370
S. 77 not in force at Royal Assent, see s. 142(1)
I371
Sch. 11 para. 21 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I372
S. 44 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I373
Sch. 9 para. 8 not in force at Royal Assent, see s. 142(1)
I374
S. 113 not in force at Royal Assent, see s. 142(1)
I375
S. 42 not in force at Royal Assent, see s. 142(1)
I376
S. 129 in force at 20.8.2025 by S.I. 2025/904, reg. 2(t)
I377
S. 72 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I378
S. 99 not in force at Royal Assent, see s. 142(1)
I379
S. 61 not in force at Royal Assent, see s. 142(1)
I380
S. 122 in force at Royal Assent for specified purposes, see s. 142(2)(c)(4)
I381
Sch. 6 para. 10 not in force at Royal Assent, see s. 142(1)
I382
Sch. 11 para. 3 not in force at Royal Assent, see s. 142(1)
I383
S. 143 in force at Royal Assent, see s. 142(2)(g)
I384
Sch. 9 para. 27 not in force at Royal Assent, see s. 142(1)
I385
Sch. 8 para. 8 not in force at Royal Assent, see s. 142(1)
I386
Sch. 11 para. 25 not in force at Royal Assent, see s. 142(1)
I387
Sch. 11 para. 20 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I388
S. 134 not in force at Royal Assent, see s. 142(1)
I389
S. 23 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I390
Sch. 7 para. 6 not in force at Royal Assent, see s. 142(1)
I391
S. 121 not in force at Royal Assent, see s. 142(1)
I392
S. 36 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I393
Sch. 6 para. 14 not in force at Royal Assent, see s. 142(1)
I394
S. 117 (except s. 117(4)(a)) in force at 20.8.2025 by S.I. 2025/904, reg. 2(r)
I395
S. 30 not in force at Royal Assent, see s. 142(1)
I396
Sch. 11 para. 5 in force at 20.8.2025 by S.I. 2025/904, reg. 2(y)
I397
S. 43 not in force at Royal Assent, see s. 142(1)
I398
Sch. 11 para. 14 not in force at Royal Assent, see s. 142(1)
I399
Sch. 9 para. 4 not in force at Royal Assent, see s. 142(1)
I400
S. 109 in force at 20.8.2025 by S.I. 2025/904, reg. 2(n)
I401
Sch. 10 para. 21 not in force at Royal Assent, see s. 142(1)
I402
S. 82 in force at 19.8.2025, see s. 142(3)(b)
I403
S. 129 not in force at Royal Assent, see s. 142(1)
I404
Sch. 6 para. 8 not in force at Royal Assent, see s. 142(1)
I405
S. 70 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I406
Sch. 6 para. 4 not in force at Royal Assent, see s. 142(1)
I407
Sch. 8 para. 7 not in force at Royal Assent, see s. 142(1)
I408
S. 32 not in force at Royal Assent, see s. 142(1)
I409
S. 52 in force at 1.12.2025 in so far as not already in force by S.I. 2025/1213, reg. 2
I410
S. 93 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(g)
I411
S. 54 in force at 1.12.2025 by S.I. 2025/1213, reg. 2
I412
Sch. 6 para. 15 not in force at Royal Assent, see s. 142(1)
I413
Sch. 3 para. 10 not in force at Royal Assent, see s. 142(1)
I414
S. 115 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I415
S. 102 not in force at Royal Assent, see s. 142(1)
I416
S. 112 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I417
Sch. 3 para. 18 not in force at Royal Assent, see s. 142(1)
I418
S. 91 not in force at Royal Assent, see s. 142(1)
I419
S. 2 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)
I420
Sch. 3 para. 5 not in force at Royal Assent, see s. 142(1)
I421
Sch. 7 para. 2 not in force at Royal Assent, see s. 142(1)
I422
S. 37 not in force at Royal Assent, see s. 142(1)
I423
S. 18 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
I424
Sch. 11 para. 31 not in force at Royal Assent, see s. 142(1)
I425
S. 113 in force at 20.8.2025 by S.I. 2025/904, reg. 2(q)
I426
Sch. 3 para. 21 not in force at Royal Assent, see s. 142(1)
I427
S. 24 not in force at Royal Assent, see s. 142(1)
I428
S. 67 in force at 5.2.2026 by S.I. 2026/82, reg. 2(a)
I429
S. 68 in force at 5.2.2026 by S.I. 2026/82, reg. 2(b)
I430
S. 70 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(c)
I431
S. 71 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(d)
I432
S. 72(3)(7) in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(e)
I433
S. 76 in force at 5.2.2026 by S.I. 2026/82, reg. 2(h) (with reg. 4)
I434
S. 77 in force at 5.2.2026 by S.I. 2026/82, reg. 2(i)
I435
S. 80 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(j) (with reg. 5)
I436
S. 81 in force at 5.2.2026 by S.I. 2026/82, reg. 2(k)
I437
S. 83 in force at 5.2.2026 by S.I. 2026/82, reg. 2(l)
I438
S. 86 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(n)
I439
S. 87 in force at 5.2.2026 by S.I. 2026/82, reg. 2(o)
I440
S. 94 in force at 5.2.2026 by S.I. 2026/82, reg. 2(p)
I441
Sch. 4 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z6)
I442
Sch. 5 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z7)
I443
Sch. 6 para. 2 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I444
Sch. 6 para. 3 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I445
Sch. 6 para. 4 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I446
Sch. 6 para. 5 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I447
Sch. 6 para. 6 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I448
Sch. 6 para. 7 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I449
Sch. 6 para. 8 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I450
Sch. 6 para. 9 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I451
Sch. 7 para. 2 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z9)
I452
Sch. 7 para. 3 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z9)
I453
Sch. 7 para. 4 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z9)
I454
Sch. 7 para. 5 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z9)
I455
Sch. 7 para. 6 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z9)
I456
Sch. 7 para. 7 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z9)
I457
Sch. 7 para. 8 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z9)
I458
Sch. 7 para. 9 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z9)
I459
Sch. 7 para. 10 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z9)
I460
Sch. 9 para. 2 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I461
Sch. 9 para. 3 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I462
Sch. 9 para. 4 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I463
Sch. 9 para. 5 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I464
Sch. 9 para. 6 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I465
Sch. 9 para. 7 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I466
Sch. 9 para. 8 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I467
Sch. 9 para. 9 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I468
Sch. 9 para. 10 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I469
Sch. 11 para. 31 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z12)
I470
S. 73 in force at 5.2.2026 by S.I. 2026/82, reg. 2(f)
I471
S. 75 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(g)
I472
S. 98 in force at 5.2.2026 by S.I. 2026/82, reg. 2(q)
I473
S. 99 in force at 5.2.2026 by S.I. 2026/82, reg. 2(r)
I474
S. 100 in force at 5.2.2026 by S.I. 2026/82, reg. 2(s)
I475
S. 101 in force at 5.2.2026 by S.I. 2026/82, reg. 2(t) (with reg. 6)
I476
S. 105 in force at 5.2.2026 by S.I. 2026/82, reg. 2(u)
I477
Sch. 13 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z14) (with regs. 8-11)
I478
S. 115 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(y) (with regs. 8-11)
I479
Sch. 6 para. 11 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I480
Sch. 6 para. 12 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I481
Sch. 6 para. 13 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I482
Sch. 6 para. 14 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I483
Sch. 6 para. 15 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I484
Sch. 6 para. 16 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I485
Sch. 8 para. 2 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I486
Sch. 8 para. 3 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I487
Sch. 8 para. 4 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z10)
I488
Sch. 8 para. 5 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I489
Sch. 8 para. 6 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I490
Sch. 8 para. 7 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I491
Sch. 8 para. 8 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I492
Sch. 8 para. 9 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I493
Sch. 8 para. 10 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I494
Sch. 9 para. 12 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I495
Sch. 9 para. 13 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I496
Sch. 9 para. 14 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I497
Sch. 9 para. 15 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I498
Sch. 9 para. 16 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I499
Sch. 9 para. 17 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I500
Sch. 9 para. 18 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I501
Sch. 9 para. 19 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I502
Sch. 9 para. 20 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I503
Sch. 9 para. 21 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I504
Sch. 9 para. 22 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I505
Sch. 9 para. 23 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I506
Sch. 9 para. 24 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I507
Sch. 9 para. 25 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I508
Sch. 11 para. 22 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z12)
I509
Sch. 11 para. 23 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z12)
I510
Sch. 11 para. 25 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z12)
I511
Sch. 11 para. 28 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z12)
I512
Sch. 11 para. 29 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z12)
I513
Sch. 11 para. 30 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z12)
I514
S. 110(2)(a)(b)(3) in force at 5.2.2026 by S.I. 2026/82, reg. 2(v)
I515
S. 112 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(w)
I516
S. 114 in force at 5.2.2026 by S.I. 2026/82, reg. 2(x)
I517
S. 116 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z)
I518
Sch. 12 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z13)
I519
S. 130 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z3)
I520
S. 132 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z4)
I521
S. 133(4) in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z5)
I522
Sch. 15 para. 2 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z15)
I523
Sch. 15 para. 3 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z15)
I524
Sch. 15 para. 4 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z15)
I525
Sch. 15 para. 5 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z15)
I526
Sch. 15 para. 6 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z15)
I527
Sch. 15 para. 7 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z15)
I528
Sch. 15 para. 8 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82, reg. 2(z15)
I529
S. 85 in force at 5.2.2026 by S.I. 2026/82, reg. 2(m)
I530
S. 120 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z1)
I531
S. 121 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z2)
I532
Sch. 6 para. 1 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I533
Sch. 6 para. 10 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z8) (with reg. 5)
I534
Sch. 7 para. 1 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z9)
I535
Sch. 8 para. 1 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)
I536
Sch. 9 para. 1 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I537
Sch. 9 para. 11 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I538
Sch. 9 para. 26 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I539
Sch. 9 para. 27 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I540
Sch. 9 para. 28 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I541
Sch. 9 para. 29 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I542
Sch. 9 para. 30 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I543
Sch. 9 para. 31 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I544
Sch. 9 para. 32 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I545
Sch. 9 para. 33 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)
I546
Sch. 15 para. 1 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z15)
I547
S. 138 in force at 6.2.2026 by S.I. 2026/31, reg. 2
I548
S. 123 in force at 12.2.2026 by S.I. 2026/126, reg. 3
I549
Sch. 11 para. 32 in force at 31.3.2026 by S.I. 2026/317, reg. 3