Data (Use and Access) Act 2025

Prospective

Section 108

Schedule 11 U.K. Further minor provision about data protection

The UK GDPR U.K.

1 The UK GDPR is amended as follows.

Commencement Information

I1 Sch. 11 para. 1 not in force at Royal Assent, see s. 142(1)

2 (1) Article 4(1) (interpretation) is amended as follows.

(2) After point (15) insert—

• “(15A) “direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;”.

(3) After point (28) insert—

• “(29) “enactment” has the same meaning as in the 2018 Act (see section 205 of that Act);

• (30) “tribunal” means any tribunal in which legal proceedings may be brought.”

Commencement Information

I2 Sch. 11 para. 2 not in force at Royal Assent, see s. 142(1)

3 After Article 4 insert—

“Article 4A Periods of time

1. References in this Regulation to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of the Periods of Time Regulation, except in Article 91A(8) and (9).

2. In this Article, “the Periods of Time Regulation” means Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.”

Commencement Information

I3 Sch. 11 para. 3 not in force at Royal Assent, see s. 142(1)

4 In Article 9 (processing of special categories of personal data)—

(a) in paragraph 2, after “apply if” insert “the processing is based on Article 6(1) and”,

(b) in paragraph 2(f), after “courts” insert “or tribunals”, and

(c) in paragraph 3, for the words from the beginning to “data are” substitute “Paragraph 1 is only disapplied by point (h) of paragraph 2 if the personal data is”.

Commencement Information

I4 Sch. 11 para. 4 not in force at Royal Assent, see s. 142(1)

5 In Article 12(5) (information etc to be provided free of charge), at the beginning insert “Subject to Article 15(3),”.

Commencement Information

I5 Sch. 11 para. 5 not in force at Royal Assent, see s. 142(1)

6 In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)”.

Commencement Information

I6 Sch. 11 para. 6 not in force at Royal Assent, see s. 142(1)

7 In Article 24(3) (responsibility of the controller), for “an element by which to demonstrate” substitute “a means of demonstrating”.

Commencement Information

I7 Sch. 11 para. 7 not in force at Royal Assent, see s. 142(1)

8 In Article 25(3) (data protection by design and by default), for “an element to demonstrate” substitute “a means of demonstrating”.

Commencement Information

I8 Sch. 11 para. 8 not in force at Royal Assent, see s. 142(1)

9 In Article 28(5) (processors), for “an element by which to demonstrate” substitute “a means of demonstrating”.

Commencement Information

I9 Sch. 11 para. 9 not in force at Royal Assent, see s. 142(1)

10 In Article 32(3) (security of processing), for “an element by which to demonstrate” substitute “a means of demonstrating”.

Commencement Information

I10 Sch. 11 para. 10 not in force at Royal Assent, see s. 142(1)

11 In Article 37(1)(a), after “courts” insert “and tribunals”.

Commencement Information

I11 Sch. 11 para. 11 not in force at Royal Assent, see s. 142(1)

12 Omit Article 59 (activity reports).

Commencement Information

I12 Sch. 11 para. 12 not in force at Royal Assent, see s. 142(1)

The 2018 Act U.K.

13 The 2018 Act is amended as follows.

Commencement Information

I13 Sch. 11 para. 13 not in force at Royal Assent, see s. 142(1)

14 In section 3(9) (definition of “the data protection legislation”)—

(a) insert “and” at the end of paragraph (c), and

(b) omit paragraph (e) (regulations under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive) and the “and” before it.

Commencement Information

I14 Sch. 11 para. 14 not in force at Royal Assent, see s. 142(1)

15 Omit section 20 (meaning of “court” in Part 2).

Commencement Information

I15 Sch. 11 para. 15 not in force at Royal Assent, see s. 142(1)

16 In section 94 (data subject’s right of access under Part 4), in subsection (10), for “subsection (6)” substitute “subsections (3), (5) and (6)”.

Commencement Information

I16 Sch. 11 para. 16 not in force at Royal Assent, see s. 142(1)

17 In section 119A(11) (standard clauses for transfers to third countries etc), after “any” insert “whole days that fall within a”.

Commencement Information

I17 Sch. 11 para. 17 not in force at Royal Assent, see s. 142(1)

18 In section 124(5) (data protection and journalism code), in the definition of “good practice in the processing of personal data for the purposes of journalism”—

(a) in paragraph (a), omit “, including compliance with the requirements of the data protection legislation”, and

(b) after paragraph (b) insert—

“and includes compliance with the requirements of the data protection legislation;”.

Commencement Information

I18 Sch. 11 para. 18 not in force at Royal Assent, see s. 142(1)

19 (1) Section 125 (approval of codes of practice prepared by the Commissioner) is amended as follows.

(2) Omit subsection (2).

(3) In subsection (8), after “any” insert “whole days that fall within a”.

(4) In subsection (9), for “subsections (2) and (5)” substitute “subsection (5)”.

Commencement Information

I19 Sch. 11 para. 19 not in force at Royal Assent, see s. 142(1)

20 In section 139 (reporting to Parliament), omit subsection (2).

Commencement Information

I20 Sch. 11 para. 20 not in force at Royal Assent, see s. 142(1)

21 In section 161(6) (approval of first guidance about regulatory action), after “any” insert “whole days that fall within a”.

Commencement Information

I21 Sch. 11 para. 21 not in force at Royal Assent, see s. 142(1)

22 In section 170(2)(a) (unlawful obtaining etc of personal data), after “preventing” insert “, investigating”.

Commencement Information

I22 Sch. 11 para. 22 not in force at Royal Assent, see s. 142(1)

23 (1) Section 171 (re-identification of de-identified personal data) is amended as follows.

(2) In subsection (3)(a), after “preventing” insert “, investigating”.

(3) In subsection (6)(a), after “preventing” insert “, investigating”.

Commencement Information

I23 Sch. 11 para. 23 not in force at Royal Assent, see s. 142(1)

24 In section 181 (interpretation of Part 6) omit the definition of “representative”.

Commencement Information

I24 Sch. 11 para. 24 not in force at Royal Assent, see s. 142(1)

25 In section 184(4) (prohibition of requirement to produce relevant records), after “prevention” insert “, investigation”.

Commencement Information

I25 Sch. 11 para. 25 not in force at Royal Assent, see s. 142(1)

26 In section 192(6) (approval of the Framework), after “any” insert “whole days that fall within a”.

Commencement Information

I26 Sch. 11 para. 26 not in force at Royal Assent, see s. 142(1)

27 In section 206 (index of defined expressions), in the Table, omit the entry for “representative (in Part 6)”.

Commencement Information

I27 Sch. 11 para. 27 not in force at Royal Assent, see s. 142(1)

28 (1) Schedule 1 (special categories of personal data and criminal convictions etc data) is amended as follows.

(2) In the heading before paragraph 10, for “or detecting” substitute “etc”.

(3) In paragraph 10(1)(a) (preventing etc unlawful acts), after “prevention” insert “, investigation”.

(4) In paragraph 13(1)(a) (journalism etc in connection with unlawful acts and dishonesty etc), after “consists of” insert “, or is carried out in preparation for,”.

(5) In paragraph 14(1)(b) (preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—

“(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii),”.

(6) In paragraph 24(1)(a) (disclosure to elected representatives), after “consists of” insert “, or is carried out in preparation for,”.

Commencement Information

I28 Sch. 11 para. 28 not in force at Royal Assent, see s. 142(1)

29 (1) Schedule 2 (exemptions etc from the UK GDPR) is amended as follows.

(2) In paragraph 2(1)(a) (crime), after “prevention” insert “, investigation”.

(3) In paragraph 3(2)(b)(ii) (crime: risk assessment systems), after “prevention” insert “, investigation”.

Commencement Information

I29 Sch. 11 para. 29 not in force at Royal Assent, see s. 142(1)

30 In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing under Part 3: preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—

“(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii),”.

Commencement Information

I30 Sch. 11 para. 30 not in force at Royal Assent, see s. 142(1)

31 In paragraph 2(a) of Schedule 11 (other exemptions under Part 4: crime), after “prevention” insert “, investigation”.

Commencement Information

I31 Sch. 11 para. 31 not in force at Royal Assent, see s. 142(1)

Victims and Prisoners Act 2024 U.K.

32 The following provisions (inserted by section 31 of the Victims and Prisoners Act 2024) extend to Scotland and Northern Ireland (as well as to England and Wales)—

(a) Article 17(1)(g), (4) and (5) of the UK GDPR (right to erasure), and

(b) section 13A of the 2018 Act (meaning of “relevant offence” for purpose of right to erasure).

Commencement Information

I32 Sch. 11 para. 32 not in force at Royal Assent, see s. 142(1)