The Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018

Provisions coming into force on 25th May 2018

2.—(1) The following provisions of the 2018 Act, so far as not already in force (see section 212(2) of the 2018 Act), come into force on 25th May 2018—

(a) section 2 (protection of personal data);

(b) Part 2 (general processing) (including Schedules 1, 2, 3, 4, 5 and 6), other than paragraph 62 of Schedule 6;

(c) Part 3 (law enforcement processing) (including Schedules 7 and 8);

(d) Part 4 (intelligence services processing) (including Schedules 9, 10 and 11), other than the provisions listed in paragraph (2);

(e) Part 5 (the Information Commissioner) (including Schedules 12, 13 and 14), other than the provisions listed in—

(i) section 212(3) of the 2018 Act; and

(ii) regulation 3;

(f) Part 6 (enforcement) (including Schedules 15, 16 and 17), other than the provisions listed in section 212(3) of the 2018 Act;

(g) Part 7 (supplementary and final provision) (including Schedules 18, 19 and 20), other than the provisions listed in—

(i) paragraph (3); and

(ii) regulation 3.

(2) The provisions referred to in paragraph (1)(d) are—

(a) section 93 (right to information);

(b) section 102 (general obligations of the controller);

(c) section 103 (data protection by design);

(d) section 104 (joint controllers);

(e) section 105 (processors);

(f) section 108 (communication of a personal data breach).

(3) The provisions referred to in paragraph (1)(g)(i) are the following paragraphs in Schedule 19—

(a) paragraph 76;

(b) paragraph 201;

(c) paragraph 211;

(d) paragraph 227.