316(1)Regulation 5 (disclosure of curricular and educational records) is amended as follows.
(2)In paragraph (4)—
(a)in sub-paragraph (a), for “the Data Protection Act 1998” substitute “the GDPR”, and
(b)in sub-paragraph (b), for “that Act or by virtue of any order made under section 30(2) or section 38(1) of the Act” substitute “the GDPR”.
(3)After paragraph (6) insert—
“(7)In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”