Regulation (EU) 2016/679 of the European Parliament and of the CouncilDangos y teitl llawn

Section 5 U.K. Restrictions

Article 23 U.K. Restrictions

1. [F1 The Secretary of State may restrict] the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

F2 (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F2 (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c) public security;

(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

(e) other important objectives of general public interest F3 ... , in particular an important economic or financial interest [F4 of the United Kingdom], including monetary, budgetary and taxation a matters, public health and social security;

(f) the protection of judicial independence and judicial proceedings;

(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points [F5 (c)] to (e) and (g);

(i) the protection of the data subject or the rights and freedoms of others;

(j) the enforcement of civil law claims.

2. In particular, [F6 provision made in exercise of the power under] paragraph 1 shall contain specific provisions at least, where relevant, as to:

(a) the purposes of the processing or categories of processing;

(b) the categories of personal data;

(c) the scope of the restrictions introduced;

(d) the safeguards to prevent abuse or unlawful access or transfer;

(e) the specification of the controller or categories of controllers;

(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

(g) the risks to the rights and freedoms of data subjects; and

(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

[F7 3. The Secretary of State may exercise the power under paragraph 1 only by making regulations under section 16 of the 2018 Act.]

Textual Amendments

F1 Words in Art. 23(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 19(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F2 Art. 23(1)(a)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 19(2)(b) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

F3 Words in Art. 23(1)(e) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 19(2)(c)(i) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

F4 Words in Art. 23(1)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 19(2)(c)(ii) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F5 Word in Art. 23(1)(h) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 6; S.I. 2025/904, reg. 2(y)

F6 Words in Art. 23(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 19(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F7 Art. 23(3) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 19(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)