Data (Use and Access) Act 2025

107 Regulations under the UK GDPR U.K.

(1) In the UK GDPR, after Chapter 9 insert—

“CHAPTER 9A U.K. Regulations

Article 91A Regulations made by Secretary of State

1. This Article makes provision about regulations made by the Secretary of State under this Regulation (“UK GDPR regulations”).

2. Before making UK GDPR regulations, the Secretary of State must consult—

(a) the Commissioner, and

(b) such other persons as the Secretary of State considers appropriate.

3. Paragraph 2 does not apply to regulations made under Article 49 or 49A where the Secretary of State has made an urgency statement in respect of them.

4. UK GDPR regulations may—

(a) make different provision for different purposes;

(b) include consequential, supplementary, incidental, transitional, transitory or saving provision.

5. UK GDPR regulations are to be made by statutory instrument.

6. For the purposes of this Regulation, where regulations are subject to “the negative resolution procedure”, the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.

7. For the purposes of this Regulation, where regulations are subject to “the affirmative resolution procedure”, the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

8. For the purposes of this Regulation, where regulations are subject to “the made affirmative resolution procedure”—

(a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and

(b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.

9. In calculating the period of 120 days, no account is to be taken of any whole days that fall within a period during which—

(a) Parliament is dissolved or prorogued, or

(b) both Houses of Parliament are adjourned for more than 4 days.

10. Where regulations cease to have effect as a result of paragraph 8, that does not—

(a) affect anything previously done under the regulations, or

(b) prevent the making of new regulations.

11. Any provision that may be included in UK GDPR regulations subject to the negative resolution procedure may be made by regulations made under this Regulation or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.

12. A requirement under this Article to consult may be satisfied by consultation before, as well as by consultation after, the provision conferring the power to make regulations comes into force.

13. In this Article, “urgency statement”, in relation to regulations, means a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.”

(2) In section 3(9) of the 2018 Act (definition of “data protection legislation”), in paragraph (d), after “Act” insert “or the UK GDPR”.

Commencement Information

I1 S. 107 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)