Data (Use and Access) Act 2025

Prospective

Section 103

Schedule 10 U.K. Complaints: minor and consequential amendments

The UK GDPR U.K.

1 The UK GDPR is amended as follows.

Commencement Information

I1 Sch. 10 para. 1 not in force at Royal Assent, see s. 142(1)

2 In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”.

Commencement Information

I2 Sch. 10 para. 2 not in force at Royal Assent, see s. 142(1)

3 (1) Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows.

(2) After point (c) insert—

“(ca) the right to make a complaint to the controller under section 164A of the 2018 Act;”.

(3) In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

Commencement Information

I3 Sch. 10 para. 3 not in force at Royal Assent, see s. 142(1)

4 (1) Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows.

(2) After point (d) insert—

“(da) the right to make a complaint to the controller (see section 164A of the 2018 Act);”.

(3) In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

Commencement Information

I4 Sch. 10 para. 4 not in force at Royal Assent, see s. 142(1)

5 (1) Article 15(1) (right of access by the data subject) is amended as follows.

(2) After point (e) insert—

“(ea) the right to make a complaint to the controller under section 164A of the 2018 Act;”.

(3) In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

Commencement Information

I5 Sch. 10 para. 5 not in force at Royal Assent, see s. 142(1)

6 In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”.

Commencement Information

I6 Sch. 10 para. 6 not in force at Royal Assent, see s. 142(1)

7 (1) Article 80 (representation of data subjects) is amended as follows.

(2) In paragraph 1—

(a) for “lodge the complaint” substitute “make a complaint under section 164A or 165 of the 2018 Act”, and

(b) omit “77,”.

(3) In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”.

Commencement Information

I7 Sch. 10 para. 7 not in force at Royal Assent, see s. 142(1)

The 2018 Act U.K.

8 The 2018 Act is amended as follows.

Commencement Information

I8 Sch. 10 para. 8 not in force at Royal Assent, see s. 142(1)

9 In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act).

Commencement Information

I9 Sch. 10 para. 9 not in force at Royal Assent, see s. 142(1)

10 (1) Section 44 (information: controller’s general duties) is amended as follows.

(2) In subsection (1)—

(a) after paragraph (d) insert—

“(da) the existence of the right to make a complaint to the controller (see section 164A);”, and

(b) in paragraph (e), after “Commissioner”, in the first place it occurs, insert “(see section 165)”.

(3) In subsection (5)—

(a) after paragraph (c) insert—

“(ca) of the data subject’s right to make a complaint to the controller under section 164A,”, and

(b) in paragraph (d), after “Commissioner” insert “under section 165”.

Commencement Information

I10 Sch. 10 para. 10 not in force at Royal Assent, see s. 142(1)

11 (1) Section 45 (right of access by the data subject) is amended as follows.

(2) In subsection (2)—

(a) after paragraph (e) insert—

“(ea) the existence of the data subject’s right to make a complaint to the controller (see section 164A);”, and

(b) in paragraph (f), after “the Commissioner”, in the first place it occurs, insert “(see section 165)”.

(3) In subsection (5)—

(a) after paragraph (c) insert—

“(ca) of the data subject’s right to make a complaint to the controller under section 164A,”, and

(b) in paragraph (d), at the end insert “under section 165”.

Commencement Information

I11 Sch. 10 para. 11 not in force at Royal Assent, see s. 142(1)

12 In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section 79 of this Act), in subsection (2), after paragraph (c) insert—

“(ca) the data subject’s right to make a complaint to the controller under section 164A,”.

Commencement Information

I12 Sch. 10 para. 12 not in force at Royal Assent, see s. 142(1)

13 (1) Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows.

(2) In subsection (1)(b)—

(a) after sub-paragraph (ii) insert—

“(iia) of the data subject’s right to make a complaint to the controller under section 164A,”, and

(b) in sub-paragraph (iii), after “Commissioner” insert “under section 165”.

(3) In subsection (4)—

(a) after paragraph (b) insert—

“(ba) of the data subject’s right to make a complaint to the controller under section 164A,”, and

(b) in paragraph (c), after “Commissioner” insert “under section 165”.

Commencement Information

I13 Sch. 10 para. 13 not in force at Royal Assent, see s. 142(1)

14 In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”.

Commencement Information

I14 Sch. 10 para. 14 not in force at Royal Assent, see s. 142(1)

15 In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”.

Commencement Information

I15 Sch. 10 para. 15 not in force at Royal Assent, see s. 142(1)

16 (1) Section 149 (enforcement notices) is amended as follows.

(2) In subsection (1), for “or (5)” substitute “, (5) or (5A)”.

(3) After subsection (5) insert—

“(5A) The fifth type of failure is where a controller has failed, or is failing, to comply with section 164A or with regulations under section 164B.”

(4) In subsection (6), for “or (5)” substitute “, (5) or (5A)”.

Commencement Information

I16 Sch. 10 para. 16 not in force at Royal Assent, see s. 142(1)

17 In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”.

Commencement Information

I17 Sch. 10 para. 17 not in force at Royal Assent, see s. 142(1)

18 In section 157 (maximum amount of penalty), after subsection (4) insert—

“(4A) In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.”

Commencement Information

I18 Sch. 10 para. 18 not in force at Royal Assent, see s. 142(1)

19 In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”.

Commencement Information

I19 Sch. 10 para. 19 not in force at Royal Assent, see s. 142(1)

20 (1) Section 166 (orders to progress complaints) is amended as follows.

(2) In the heading, at the end insert “to the Commissioner”.

(3) In subsection (1), omit “or Article 77 of the UK GDPR”.

Commencement Information

I20 Sch. 10 para. 20 not in force at Royal Assent, see s. 142(1)

21 (1) Section 187 (representation of data subjects with their authority) is amended as follows.

(2) In subsection (1)(a)—

(a) for “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles”, and

(b) omit “to lodge complaints and”.

(3) In subsection (2)—

(a) before paragraph (a) insert—

“(za) the right under section 164A (complaints to the controller);”, and

(b) in paragraph (a), for “165(2) and (4)(d)” substitute “165”.

Commencement Information

I21 Sch. 10 para. 21 not in force at Royal Assent, see s. 142(1)