Search Legislation

Data Protection Act 2018

 Help about what version

What Version

 Help about advanced features

Advanced Features

Changes to legislation:

There are outstanding changes not yet made by the legislation.gov.uk editorial team to Data Protection Act 2018. Any changes that have already been made by the team appear in the content and are referenced with annotations. Help about Changes to Legislation

Close

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.

View outstanding changes

Changes and effects yet to be applied to Schedule 2 Part 2:

Changes and effects yet to be applied to the whole Act associated Parts and Chapters:

Whole provisions yet to be inserted into this Act (including any effects on those provisions):

PART 2U.K.Restrictions [F1as described in] Article 23(1): restrictions of rules in Articles 13 to 21 and 34

[F2UK GDPR] provisions to be restricted: “the listed GDPR provisions”U.K.

6U.K.In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the [F3UK GDPR] (the rights and obligations in which may be restricted by virtue of Article 23(1) of the [F3UK GDPR])—

(a)Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b)Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c)Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d)Article 16 (right to rectification);

(e)Article 17(1) and (2) (right to erasure);

(f)Article 18(1) (restriction of processing);

(g)Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(h)Article 20(1) and (2) (right to data portability);

(i)Article 21(1) (objections to processing);

(j)Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).

Functions designed to protect the public etcU.K.

7U.K.The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—

(a)is designed as described in column 1 of the Table, and

(b)meets the condition relating to the function specified in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

TABLE
Description of function designCondition

1. The function is designed to protect members of the public against—

(a)

financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate, or

(b)

financial loss due to the conduct of discharged or undischarged bankrupts.

The function is—

(a)

conferred on a person by an enactment,

(b)

a function of the Crown, a Minister of the Crown or a government department, or

(c)

of a public nature, and is exercised in the public interest.

2. The function is designed to protect members of the public against—

(a)

dishonesty, malpractice or other seriously improper conduct, or

(b)

unfitness or incompetence.

The function is—

(a)

conferred on a person by an enactment,

(b)

a function of the Crown, a Minister of the Crown or a government department, or

(c)

of a public nature, and is exercised in the public interest.

3. The function is designed—

(a)

to protect charities or community interest companies against misconduct or mismanagement (whether by trustees, directors or other persons) in their administration,

(b)

to protect the property of charities or community interest companies from loss or misapplication, or

(c)

to recover the property of charities or community interest companies.

The function is—

(a)

conferred on a person by an enactment,

(b)

a function of the Crown, a Minister of the Crown or a government department, or

(c)

of a public nature, and is exercised in the public interest.

4. The function is designed—

(a)

to secure the health, safety and welfare of persons at work, or

(b)

to protect persons other than those at work against risk to health or safety arising out of or in connection with the action of persons at work.

The function is—

(a)

conferred on a person by an enactment,

(b)

a function of the Crown, a Minister of the Crown or a government department, or

(c)

of a public nature, and is exercised in the public interest.

5. The function is designed to protect members of the public against—

(a)

maladministration by public bodies,

(b)

failures in services provided by public bodies, or

(c)

a failure of a public body to provide a service which it is a function of the body to provide.

The function is conferred by any enactment on—

(a)

the Parliamentary Commissioner for Administration,

(b)

the Commissioner for Local Administration in England,

(c)

the Health Service Commissioner for England,

(d)

the Public Services Ombudsman for Wales,

(e)

the Northern Ireland Public Services Ombudsman,

(f)

the Prison Ombudsman for Northern Ireland, or

(g)

the Scottish Public Services Ombudsman.

6. The function is designed—

(a)

to protect members of the public against conduct which may adversely affect their interests by persons carrying on a business,

(b)

to regulate agreements or conduct which have as their object or effect the prevention, restriction or distortion of competition in connection with any commercial activity, or

(c)

to regulate conduct on the part of one or more undertakings which amounts to the abuse of a dominant position in a market.

The function is conferred on the Competition and Markets Authority by an enactment.

Audit functionsU.K.

8(1)The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.U.K.

(2)The functions are any function that is conferred by an enactment on—

(a)the Comptroller and Auditor General;

(b)the Auditor General for Scotland;

(c)the Auditor General for Wales;

(d)the Comptroller and Auditor General for Northern Ireland.

Functions of the Bank of EnglandU.K.

9(1)The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.U.K.

(2)Relevant function of the Bank of England” means—

(a)a function discharged by the Bank acting in its capacity as a monetary authority (as defined in section 244(2)(c) and (2A) of the Banking Act 2009);

(b)a public function of the Bank within the meaning of section 349 of the Financial Services and Markets Act 2000;

(c)a function conferred on the Prudential Regulation Authority by or under the Financial Services and Markets Act 2000 or by another enactment.

Regulatory functions relating to legal services, the health service and children's servicesU.K.

10(1)The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.U.K.

(2)The functions are—

(a)a function of the Legal Services Board;

(b)the function of considering a complaint under the scheme established under Part 6 of the Legal Services Act 2007 (legal complaints);

(c)the function of considering a complaint under—

(i)section 14 of the NHS Redress Act 2006,

(ii)section 113(1) or (2) or section 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003,

(iii)section 24D or 26 of the Children Act 1989, or

(iv)Part 2A of the Public Services Ombudsman (Wales) Act 2005 [F4or Part 5 of the Public Services Ombudsman (Wales) Act 2019];

(d)the function of considering a complaint or representations under Chapter 1 of Part 10 of the Social Services and Well-being (Wales) Act 2014 (anaw 4).

Textual Amendments

F4Words in Sch. 2 para. 10(2)(c)(iv) inserted (E.W.) (23.7.2019) by Public Services Ombudsman (Wales) Act 2019 (anaw 3), s. 77(1), Sch. 5 para. 28; S.I. 2019/1096, reg. 2

Regulatory functions of certain other personsU.K.

11U.K.The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—

(a)is a function of a person described in column 1 of the Table, and

(b)is conferred on that person as described in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

TABLE
Person on whom function is conferredHow function is conferred
1. The Commissioner.

By or under—

(a)

the data protection legislation;

(b)

the Freedom of Information Act 2000;

(c)

section 244 of the Investigatory Powers Act 2016;

(d)

the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426);

(e)

the Environmental Information Regulations 2004 (S.I. 2004/3391);

(f)

the INSPIRE Regulations 2009 (S.I. 2009/3157);

(g)

Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;

(h)

the Re-use of Public Sector Information Regulations 2015 (S.I. 2015/1415);

(i)

the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696).

2. The Scottish Information Commissioner.

By or under—

(a)

the Freedom of Information (Scotland) Act 2002 (asp 13);

(b)

the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520);

(c)

the INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440).

3. The Pensions Ombudsman.By or under Part 10 of the Pension Schemes Act 1993 or any corresponding legislation having equivalent effect in Northern Ireland.
4. The Board of the Pension Protection Fund.By or under sections 206 to 208 of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.
5. The Ombudsman for the Board of the Pension Protection Fund.By or under any of sections 209 to 218 or 286(1) of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.
6. The Pensions Regulator.By an enactment.
7. The Financial Conduct Authority.By or under the Financial Services and Markets Act 2000 or by another enactment.
8. The Financial Ombudsman.By or under Part 16 of the Financial Services and Markets Act 2000.
9. The investigator of complaints against the financial regulators.By or under Part 6 of the Financial Services Act 2012.
F5. . .F5. . .
11. The monitoring officer of a relevant authority.By or under the Local Government and Housing Act 1989.
12. The monitoring officer of a relevant Welsh authority.By or under the Local Government Act 2000.
13. The Public Services Ombudsman for Wales.By or under the Local Government Act 2000.
14. The Charity Commission.

By or under—

(a)

the Charities Act 1992;

(b)

the Charities Act 2006;

(c)

the Charities Act 2011.

Textual Amendments

Modifications etc. (not altering text)

C1Sch. 2 para. 11 table modified (28.1.2021 for specified purposes, 30.7.2022 in so far as not already in force) by The Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2021 (S.I. 2021/90), arts. 1(2)(3), 15(2)

12U.K.In the Table in paragraph 11—

  • F6...

  • F6...

  • the “Financial Ombudsman” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act);

  • the “investigator of complaints against the financial regulators” means the person appointed under section 84(1)(b) of the Financial Services Act 2012;

  • relevant authority” has the same meaning as in section 5 of the Local Government and Housing Act 1989, and “monitoring officer”, in relation to such an authority, means a person designated as such under that section;

  • relevant Welsh authority” has the same meaning as “relevant authority” in section 49(6) of the Local Government Act 2000, and “monitoring officer”, in relation to such an authority, has the same meaning as in Part 3 of that Act.

Parliamentary privilegeU.K.

13U.K.The listed GDPR provisions and Article 34(1) and (4) of the [F7UK GDPR] (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

Judicial appointments, judicial independence and judicial proceedingsU.K.

14(1)The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for judicial office or the office of Queen's Counsel.U.K.

(2)The listed GDPR provisions do not apply to personal data processed by—

(a)an individual acting in a judicial capacity, or

(b)a court or tribunal acting in its judicial capacity.

(3)As regards personal data not falling within sub-paragraph (1) or (2), the listed GDPR provisions do not apply to the extent that the application of those provisions would be likely to prejudice judicial independence or judicial proceedings.

Crown honours, dignities and appointmentsU.K.

15(1)The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.U.K.

(2)The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for any of the following offices—

(a)archbishops and diocesan and suffragan bishops in the Church of England;

(b)deans of cathedrals of the Church of England;

(c)deans and canons of the two Royal Peculiars;

(d)the First and Second Church Estates Commissioners;

(e)lord-lieutenants;

(f)Masters of Trinity College and Churchill College, Cambridge;

(g)the Provost of Eton;

(h)the Poet Laureate;

(i)the Astronomer Royal.

(3)The Secretary of State may by regulations amend the list in sub-paragraph (2) to—

(a)remove an office, or

(b)add an office to which appointments are made by Her Majesty.

(4)Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.

Commencement Information

I1Sch. 2 para. 15 in force at Royal Assent for specified purposes, see s. 212(2)(f)

Back to top

Options/Help

Print Options

You have chosen to open The Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open The Whole Act as a PDF

The Whole Act you have selected contains over 200 provisions and might take some time to download.

Would you like to continue?

You have chosen to open the Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open the Whole Act without Schedules

The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open Schedules only

The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

Close

Legislation is available in different versions:

Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.

Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.

Close

See additional information alongside the content

Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.

Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.

Close

Opening Options

Different options to open legislation in order to view more content on screen at once

Close

Explanatory Notes

Text created by the government department responsible for the subject matter of the Act to explain what the Act sets out to achieve and to make the Act accessible to readers who are not legally qualified. Explanatory Notes were introduced in 1999 and accompany all Public Acts except Appropriation, Consolidated Fund, Finance and Consolidation Acts.

Close

More Resources

Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as enacted version that was used for the print copy
  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • correction slips
  • links to related legislation and further information resources
Close

Timeline of Changes

This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.

Close

More Resources

Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as enacted version that was used for the print copy
  • correction slips

Click 'View More' or select 'More Resources' tab for additional information including:

  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • links to related legislation and further information resources