http://www.legislation.gov.uk/uksi/2019/419The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019texttext/xmlenEXITING THE EUROPEAN UNIONDATA PROTECTIONELECTRONIC COMMUNICATIONSStatute Law Database2025-03-04Expert Participation2025-02-27 These Regulations make amendments to legislation in relation to the regulation of the processing of personal data. The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019Sch. 2 para. 102The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019reg. 2(2)reg. 1The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019Sch. 2 para. 102The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019reg. 2(3)reg. 1The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019Sch. 2 para. 102The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019reg. 2(4)reg. 1 The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 2019 No. 419Exiting The European UnionData ProtectionElectronic CommunicationsThe Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019Made28th February 2019Coming into force in accordance with regulation 1(2) and (3)The Secretary of State makes these Regulations in exercise of the powers conferred by sections 8(1) and 23(1) of, paragraph 1(1) of Schedule 4 to and paragraph 21 of Schedule 7 to the European Union (Withdrawal) Act 2018 , section 211(2) of the Data Protection Act 2018 and section 2(2) of the European Communities Act 1972 .In accordance with paragraph 3(1) of Schedule 4 to the European Union (Withdrawal) Act 2018, these Regulations are made with the consent of the Treasury.The Secretary of State is a Minister designated for purposes of section 2(2) of the European Communities Act 1972 in respect of matters relating to electronic communications.In accordance with paragraphs 1(1) and 12(1) of Schedule 7 to the European Union (Withdrawal) Act 2018, section 211(5) of the Data Protection Act 2018 and paragraph 2(2) of Schedule 2 to the European Communities Act 1972 a draft of this instrument has been laid before, and approved by a resolution of, each House of Parliament.Citation, commencement and extent11These Regulations may be cited as the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.2Subject to paragraph (3), they come into force on exit day.3Regulations 7 and 8 and Schedule 4 come into force on 29th March 2019.4An amendment, repeal or revocation made by these Regulations has the same extent in the United Kingdom as the provision to which it relates.Interpretation2In these Regulations—“the 2018 Act” means the Data Protection Act 2018;“the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.Amendment of the UK GDPR3Schedule 1 amends the UK GDPR.Amendment of the Data Protection Act 20184Schedule 2 amends the 2018 Act.GDPR merger modifications51Schedules 1 and 2 include modifications (“the GDPR merger modifications”) that merge the provisions relating to the processing of personal data that, immediately before IP completion day, are found in the EU GDPR and the applied GDPR, read with the 2018 Act.2Assimilated case law falling within paragraph (3) is not, by virtue of the GDPR merger modifications, to be treated as relevant to the UK GDPR or the 2018 Act as they apply to applied GDPR processing on and after IP completion day.3Assimilated case law falls within this paragraph so far as it is, or is derived from, principles or decisions that are not relevant to any of the following immediately before IP completion day—athe applied GDPR,bthe applied Chapter 2, orcParts 5 to 7 of the 2018 Act so far as they apply to applied GDPR processing,having regard (among other things) to the limits of EU competence immediately before IP completion day.4In this regulation—“the applied Chapter 2” means Chapter 2 of Part 2 of the 2018 Act as applied by Chapter 3 of that Part immediately before IP completion day (see section 22 of that Act);“the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 of the 2018 Act as it has effect immediately before IP completion day (see section 22 of that Act);“applied GDPR processing” means the processing of personal data to which the applied GDPR applied immediately before IP completion day (see section 21 of the 2018 Act);“assimilated case law” has the same meaning as in the European Union (Withdrawal) Act 2018 (see section 6(7) of that Act);“the EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law immediately before IP completion day ....Consequential amendments of other legislation6In Schedule 3—aPart 1 revokes certain retained EU law;bPart 2 contains amendments of primary legislation (as defined in section 211(7) of the 2018 Act) that are consequential on Schedules 1 and 2;cPart 3 contains amendments of other legislation that are consequential on those Schedules;dPart 4 contains modifications of legislation that are consequential on those Schedules;ePart 5 contains supplementary provision.Amendments consequential on provisions of the 2018 Act7Schedule 4 contains amendments consequential on provisions of the 2018 Act.Amendment of the Privacy and Electronic Communications Regulations 200381Regulation 2 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 is amended as follows.2In paragraph (1), at the appropriate place, insert—“consent” by a user or subscriber corresponds to the data subject's consent in the GDPR (as defined in section 3(10) of the Data Protection Act 2018);.3Omit paragraph (3).We consent to the making of these RegulationsPaul MaynardJeremy Quin Two of the Lords Commissioners of Her Majesty's TreasuryMargot James Minister of State
Department for Digital, Culture, Media and Sport
SCHEDULE 1Amendments of the UK GDPR Regulation 3Introduction1The UK GDPR is amended as follows.2In the title of the Regulation, for “, and repealing Directive 95/46/EC (General Data Protection Regulation)” substitute “(United Kingdom General Data Protection Regulation)”.Chapter 1 (general provisions)3In Article 1, omit paragraph 3.41Article 2 is amended as follows.2For paragraph 1 substitute—1This Regulation applies to the automated or structured processing of personal data, including—aprocessing in the course of an activity which, immediately before IP completion day, fell outside the scope of EU law, andbprocessing in the course of an activity which, immediately before IP completion day, fell within the scope of Chapter 2 of Title 5 of the Treaty on European Union (common foreign and security policy activities).1AThis Regulation also applies to the manual unstructured processing of personal data held by an FOI public authority..3For paragraph 2 substitute—2This Regulation does not apply to—athe processing of personal data by an individual in the course of a purely personal or household activity;bthe processing of personal data by a competent authority for any of the law enforcement purposes (see Part 3 of the 2018 Act);cthe processing of personal data to which Part 4 of the 2018 Act (intelligence services processing) applies..4Omit paragraph 3.5In paragraph 4, for “Directive 2000/31/EC” to the end substitute “the Electronic Commerce (EC Directive) Regulations 2002 , in particular the provisions about mere conduits, caching and hosting (see regulations 17 to 19 of those Regulations).”.6After paragraph 4 insert—5In this Article—a‘the automated or structured processing of personal data’ means—ithe processing of personal data wholly or partly by automated means, andiithe processing otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system;b‘the manual unstructured processing of personal data’ means the processing of personal data which is not the automated or structured processing of personal data;c‘FOI public authority’ has the same meaning as in Chapter 3 of Part 2 of the 2018 Act (see section 21(5) of that Act);dreferences to personal data ‘held’ by an FOI public authority are to be interpreted in accordance with section 21(6) and (7) of the 2018 Act;e‘competent authority’ and ‘law enforcement purposes’ have the same meaning as in Part 3 of the 2018 Act (see sections 30 and 31 of that Act)..51Article 3 is amended as follows.2In paragraph 1, for “the Union” (in both places) substitute “ the United Kingdom ”.3In paragraph 2—abefore “processing” (in the first place) insert “ relevant ”;bfor “the Union” (in each place) substitute “ the United Kingdom ”.4After paragraph 2 insert—2AIn paragraph 2, “relevant processing of personal data” means processing to which this Regulation applies, other than processing described in Article 2(1)(a) or (b) or (1A)..5In paragraph 3—afor “the Union” substitute “ the United Kingdom ”;bfor “Member State law” substitute “ domestic law ”.61Article 4 is amended as follows.2Before paragraph (1) insert—A1‘the 2018 Act’ means the Data Protection Act 2018;A2‘domestic law’ means the law of the United Kingdom or of a part of the United Kingdom;A3‘the Commissioner’ means the Information Commissioner (see section 114 of the 2018 Act);.3In paragraph (7), for “; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law” substitute “ (but see section 6 of the 2018 Act) ”.4In paragraph (9), for “Union or Member State law” substitute “ domestic law ”.5After paragraph (10) insert—10A‘public authority’ and ‘public body’ are to be interpreted in accordance with section 7 of the 2018 Act and provision made under that section;.6Omit paragraph (16).7In paragraph (17), for “the Union” substitute “ the United Kingdom ”.8In paragraph (20), for “on the territory of a Member State” substitute “ in the United Kingdom ”.9Omit paragraph (21).10After paragraph (21) insert—21A‘foreign designated authority’ means an authority designated for the purposes of Article 13 of the Data Protection Convention (as defined in section 3 of the 2018 Act) by a party, other than the United Kingdom, which is bound by that Convention;.11Omit paragraphs (22), (23) and (24).12In paragraph (25), at the end insert “as it has effect immediately before IP completion day”.13After paragraph (26) insert—27‘third country’ means a country or territory outside the United Kingdom;28references to a fundamental right or fundamental freedom (however expressed) are to a fundamental right or fundamental freedom which continues to form part of domestic law on and after IP completion day by virtue of section 4 of the European Union (Withdrawal) Act 2018, as the right or freedom is amended or otherwise modified by domestic law from time to time on or after IP completion day..Chapter 2 (principles)71Article 6 is amended as follows.2Omit paragraph 2.3In paragraph 3—ain the first subparagraph, for points (a) and (b) (and the colon before them) substitute “ domestic law ”;bin the second subparagraph, for “The Union or Member State law” substitute “ The domestic law ”.4In paragraph 4—afor “a Union or Member State law” substitute “ domestic law ”;bafter “safeguard” insert “ national security, defence or any of ”.81Article 8 is amended as follows.2In paragraph 1—afor “16 years old” substitute “ 13 years old ”;bfor “of 16 years” substitute “ of 13 years ”;comit the second subparagraph.3In paragraph 3, for “of Member States” substitute “ as it operates in domestic law ”.4After paragraph 3 insert—4In paragraph 1, the reference to information society services does not include preventive or counselling services..91Article 9 is amended as follows.2In paragraph 2(a), for “Union or Member State law provide” substitute “ domestic law provides ”.3In paragraph 2(b)—afor “Union or Member State law” substitute “ domestic law ”;bfor “to Member State law” substitute “ to domestic law ”.4In paragraph 2(g), for “Union or Member State law” substitute “ domestic law ”.5In paragraph 2(h), for “Union or Member State law” substitute “ domestic law ”.6In paragraph 2(i), for “Union or Member State law” substitute “ domestic law ”.7paragraph 2(j)—aafter “Article 89(1)” insert “ (as supplemented by section 19 of the 2018 Act) ”;bfor “Union or Member State law” substitute “ domestic law ”.8In paragraph 3, for “Union or Member State law” (in both places) substitute “ domestic law ”.9After that paragraph insert—3AIn paragraph 3, ‘national competent bodies’ means competent bodies of the United Kingdom or a part of the United Kingdom..10Omit paragraph 4.11After that paragraph insert—5In the 2018 Act—asection 10 makes provision about when the requirement in paragraph 2(b), (g), (h), (i) or (j) of this Article for authorisation by, or a basis in, domestic law is met;bsection 11(1) makes provision about when the processing of personal data is carried out in circumstances described in paragraph 3 of this Article..101Article 10 is amended as follows.2The existing text becomes paragraph 1.3In that paragraph, for “Union or Member State law” substitute “ domestic law ”.4After that paragraph insert—2In the 2018 Act—asection 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met;bsection 11(2) makes provision about the meaning of “personal data relating to criminal convictions and offences or related security measures”..Chapter 3 (rights of the data subject)111Article 12 is amended as follows.2In paragraph 4, for “a supervisory authority” substitute “ the Commissioner ”.3After paragraph 6 insert—6AThe Commissioner may publish (and amend or withdraw)—astandardised icons for use in combination with information provided to data subjects under Articles 13 and 14;ba notice stating that other persons may publish (and amend or withdraw) such icons, provided that the icons satisfy requirements specified in the notice as to the information to be presented by the icons and the procedures for providing the icons.6BThe Commissioner must not publish icons or a notice under paragraph 6A unless satisfied (as appropriate) that the icons give a meaningful overview of the intended processing in an easily visible, intelligible and clearly legible manner or that the notice will result in icons that do so..4In paragraph 7—afor “The information” substitute “ If standardised icons are published as described in paragraph 6A (and not withdrawn), the information ”;bfor “standardised” to “processing” substitute “ the icons ”.5Omit paragraph 8.121Article 13 is amended as follows.2In paragraph 1(f), for “an adequacy decision by the Commission” substitute “ relevant adequacy regulations under section 17A of the 2018 Act ”.3In paragraph 2(d), for “a supervisory authority” substitute “ the Commissioner ”.131Article 14 is amended as follows.2In paragraph 1(f), for “an adequacy decision by the Commission” substitute “ relevant adequacy regulations under section 17A of the 2018 Act ”.3In paragraph 2(e), for “a supervisory authority” substitute “ the Commissioner ”.4In paragraph 5(c), for “Union or Member State law to which the controller is subject and” substitute “ a provision of domestic law ”.5In paragraph 5(d), for “Union or Member State law” substitute “ domestic law ”.14In Article 15(1)(f), for “a supervisory authority” substitute “ the Commissioner ”.151Article 17 is amended as follows.2In paragraph 1(e), for “in Union or Member State law to which the controller is subject” substitute “ under domestic law ”.3In paragraph 3(b), for “by Union or Member State law to which the controller is subject” substitute “ under domestic law ”.16In Article 18(2), omit “of the Union or of a Member State”.17In Article 21(5)—aomit “and notwithstanding Directive 2002/58/EC ,”;bat the end insert “ , notwithstanding domestic law made before IP completion day implementing Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ” .181Article 22 is amended as follows.2In paragraph 2(b), for “authorised by Union or Member State law to which the controller is subject and” substitute “ required or authorised by domestic law ”.3After paragraph 3 insert—3ASection 14 of the 2018 Act, and regulations under that section, make provision to safeguard data subjects' rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph)..191Article 23 is amended as follows.2In paragraph 1—afor “Union or Member State law to which the data controller or processor is subject may restrict by way of legislative measure” substitute “ The Secretary of State may restrict ”;bomit points (a) and (b);cin point (e)—iomit “of the Union or of a Member State” in the first place it occurs;iifor “of the Union or of a Member State”, in the second place it occurs, substitute “ of the United Kingdom ”.3In paragraph 2, for “any legislative measure referred to in” substitute “ provision made in exercise of the power under ”.4After that paragraph insert—3The Secretary of State may exercise the power under paragraph 1 only by making regulations under section 16 of the 2018 Act..Chapter 4 (controller and processor)20In Article 26(1), for “Union or Member State law to which the controllers are subject” substitute “ domestic law ”.211Article 27 is amended as follows.2In the heading, for “the Union” substitute “the United Kingdom.3In paragraph 1, for “the Union” substitute “the United Kingdom.4Omit paragraph 3.5In paragraph 4, for “supervisory authorities” substitute “ the Commissioner ”.221Article 28 is amended as follows.2In paragraph 3—ain the opening words, for “Union or Member State law” substitute “ domestic law ”;bin point (a), for “Union or Member State law to which the processor is subject” substitute “ domestic law ”;cin point (g), for “Union or Member State law” substitute “ domestic law ”;din the second subparagraph, for “other Union or Member State data protection provisions” substitute “ other domestic law relating to data protection ”.3In paragraph 4, “for Union or Member State law” substitute “ domestic law ”.4In paragraph 6, for “paragraphs 7 and 8” substitute “ paragraph 8 ”.5Omit paragraph 7.6In paragraph 8—afor “A supervisory authority” substitute “ The Commissioner ”;bomit “and in accordance with the consistency mechanism referred to in Article 63”.23In Article 29, for “Union or Member State law” substitute “ domestic law ”.241Article 30 is amended as follows.2In paragraph 1(g), after “Article 32(1)” insert “ or, as appropriate, the security measures referred to in section 28(3) of the 2018 Act ”.3In paragraph 2(d), after “Article 32(1)” insert “ or, as appropriate, the security measures referred to in section 28(3) of the 2018 Act ”.4In paragraph 4, for “the supervisory authority” substitute “ the Commissioner ”.251Article 31 is amended as follows.2In the heading, for “the supervisory authority” substitute “ the Commissioner ”.3For “the supervisory authority in the performance of its tasks” substitute “ the Commissioner in the performance of the Commissioner's tasks ”.26In Article 32(4), for “Union or Member State law” substitute “ domestic law ”.271Article 33 is amended as follows.2In the heading, for “the supervisory authority” substitute “ the Commissioner ”.3In paragraph 1—afor “the supervisory authority competent in accordance with Article 55” substitute “ the Commissioner ”;bfor “the notification to the supervisory authority” substitute “ the notification under this paragraph ”.4In paragraph 5, for “the supervisory authority” substitute “ the Commissioner ”.28In Article 34(4), for “the supervisory authority” substitute “ the Commissioner ”.291Article 35 is amended as follows.2In paragraph 4—ain the first sentence, for “The supervisory authority” substitute “ The Commissioner ”;bomit the second sentence.3In paragraph 5—ain the first sentence, for “The supervisory authority” substitute “ The Commissioner ”;bomit the second sentence.4Omit paragraph 6.5For paragraph 10 substitute—10In the case of processing pursuant to point (c) or (e) of Article 6(1), paragraphs 1 to 7 of this Article do not apply if a data protection impact assessment has already been carried out for the processing as part of a general impact assessment required by domestic law, unless domestic law provides otherwise..301Article 36 is amended as follows.2In paragraph 1, for “the supervisory authority” substitute “ the Commissioner ”.3In paragraph 2—ain the first sentence, for “the supervisory authority” (in both places) substitute “ the Commissioner ”;bin the third sentence, for “The supervisory authority” substitute “ The Commissioner ”;cin the last sentence, for “the supervisory authority has obtained information it” substitute “ the Commissioner has obtained information the Commissioner ”.4In paragraph 3—ain the opening words, for “the supervisory authority” (in both places) substitute “ the Commissioner ”;bin point (f), for “the supervisory authority” substitute “ the Commissioner ”.5In paragraph 4—afor “Members States shall consult the supervisory authority” substitute “ The relevant authority must consult the Commissioner ”;bfor “a national parliament” substitute “ Parliament, the National Assembly for Wales, the Scottish Parliament or the Northern Ireland Assembly ”.6After that paragraph insert—4AIn paragraph 4, “the relevant authority” means—ain relation to a legislative measure adopted by Parliament, or a regulatory measure based on such a legislative measure, the Secretary of State;bin relation to a legislative measure adopted by the National Assembly for Wales, or a regulatory measure based on such a legislative measure, the Welsh Ministers;cin relation to a legislative measure adopted by the Scottish Parliament, or a regulatory measure based on such a legislative measure, the Scottish Ministers;din relation to a legislative measure adopted by the Northern Ireland Assembly, or a regulatory measure based on such a legislative measure, the relevant Northern Ireland department..7Omit paragraph 5.311Article 37 is amended as follows.2In paragraph 4, omit “or, where required by Union or Member State law shall,”.3In paragraph 7, for “the supervisory authority” substitute “ the Commissioner ”.32In Article 38(5), for “Union or Member State law” substitute “ domestic law ”.331Article 39 is amended as follows.2In paragraph 1(a) and (b), for “other Union or Member State data protection provisions” substitute “ other domestic law relating to data protection ”.3In paragraph 1(d) and (e), for “the supervisory authority” substitute “ the Commissioner ”.341Article 40 is amended as follows.2In paragraph 1, for “The Member States, the supervisory authorities, the Board and the Commission” substitute “ The Commissioner ”.3In paragraph 2(i), for “supervisory authorities” substitute “ the Commissioner ”.4In paragraph 3, omit “and having general validity pursuant to paragraph 9 of this Article”.5In paragraph 4, for “supervisory authorities competent pursuant to Article 55 or 56” substitute “ the Commissioner ”.6In paragraph 5—afor “the supervisory authority which is competent pursuant to Article 55. The supervisory authority” substitute “ the Commissioner, who ”;bfor “it finds” substitute “ the Commissioner finds ”.7In paragraph 6, for “and where the code of conduct concerned does not relate to processing activities in several Member States, the supervisory authority” substitute “ the Commissioner ”.8Omit paragraphs 7, 8, 9, 10 and 11.351Article 41 is amended as follows.2In paragraph 1, for “the competent supervisory authority” (in both places) substitute “ the Commissioner ”.3In paragraph 2(a) and (d), for “the competent supervisory authority” substitute “ the Commissioner ”.4Omit paragraph 3.5In paragraph 4, for “the competent supervisory authority” (in both places) substitute “ the Commissioner ”.6In paragraph 5, for “The competent supervisory authority” substitute “ The Commissioner ”.361Article 42 is amended as follows.2In paragraph 1—afor “The Member States, the supervisory authorities, the Board and the Commission” substitute “ The Commissioner ”;bomit “, in particular at Union level,”.3In paragraph 4, for “the supervisory authorities which are competent pursuant to Article 55 or 56” substitute “ the Commissioner ”.4In paragraph 5—afor “the competent supervisory authority” substitute “ the Commissioner ”;bfor “that competent supervisory authority” substitute “ the Commissioner ”;comit “or by the Board pursuant to Article 63” and the second sentence.5In paragraph 6, for “the competent supervisory authority” substitute “ the Commissioner ”.6In paragraph 7, for “the competent supervisory authority” substitute “ the Commissioner ”.7In paragraph 8, for “The Board” substitute “ The Commissioner ”.371Article 43 is amended as follows.2In paragraph 1—ain the opening words—ifor “the competent supervisory authority” substitute “ the Commissioner ”;iifor “the supervisory authority” substitute “ the Commissioner ”;iiifor “Members States shall ensure that those certification bodies are” substitute “ In accordance with section 17 of the 2018 Act, those certification bodies may only be ”;bfor point (a) substitute—athe Commissioner;;cin point (b)—ifor “the national accreditation body” substitute “ the UK national accreditation body ”;iifor “the supervisory authority which is competent pursuant to Article 55 or 56” substitute “ the Commissioner ”.3In paragraph 2—ain point (a), for “the competent supervisory authority” substitute “ the Commissioner ”;bin point (b), for “the supervisory authority” to the end substitute “ the Commissioner ”;cin point (e), for “the competent supervisory authority” substitute “ the Commissioner ”.4In paragraph 3, for “the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63” substitute “ the Commissioner ”.5In paragraph 5, for “the competent supervisory authorities” substitute “ the Commissioner ”.6In paragraph 6—afor “the supervisory authority” substitute “ the Commissioner ”;bomit from “The supervisory authorities” to the end.7In paragraph 7, for “the competent supervisory authority or the national accreditation body” substitute “ the Commissioner or the UK national accreditation body ”.8Omit paragraphs 8 and 9.Chapter 5 (transfers of personal data to third countries or international organisations)381Article 45 is amended as follows.2In paragraph 1, for “where the Commission” to the end of the first sentence substitute “ where it is based on adequacy regulations (see section 17A of the 2018 Act) ”.3In paragraph 2—afor “, the Commission” substitute “ for the purposes of sections 17A and 17B of the 2018 Act, the Secretary of State ”;bin point (b), for “the supervisory authorities of the Member States” substitute “ the Commissioner ”.4Omit paragraphs 3, 4, 5 and 6.5In paragraph 7, for “A decision pursuant to paragraph 5 of this Article” substitute “ The amendment or revocation of regulations under section 17A of the 2018 Act ”.6Omit paragraphs 8 and 9.391Article 46 is amended as follows.2In paragraph 1, for “a decision pursuant to Article 45(3)” substitute “ adequacy regulations under section 17A of the 2018 Act ”.3In paragraph 2—afor “a supervisory authority” substitute “ the Commissioner ”;bfor paragraph (c) substitute—cstandard data protection clauses specified in regulations made by the Secretary of State under section 17C of the 2018 Act and for the time being in force;;cfor paragraph (d) substitute—dstandard data protection clauses specified in a document issued (and not withdrawn) by the Commissioner under section 119A of the 2018 Act and for the time being in force;.4In paragraph 3, for “Subject to the authorisation from the competent supervisory authority” substitute “ With authorisation from the Commissioner ”.5Omit paragraphs 4 and 5.401Article 47 is amended as follows.2In paragraph 1—afor “The competent supervisory authority” substitute “ The Commissioner ”;bomit “in accordance with the consistency mechanism set out in Article 63”.3In paragraph 2(e), for “the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79” substitute “ the Commissioner and before a court in accordance with Article 79 (see section 180 of the 2018 Act) ”.4In paragraph 2(f)—afor “established on the territory of a Member State” substitute “ established in the United Kingdom ”;bfor “not established in the Union” substitute “ not established in the United Kingdom ”.5In paragraph 2(j), for “the competent supervisory authority” substitute “ the Commissioner ”.6In paragraph 2(k), for “the supervisory authority” substitute “ the Commissioner ”.7In paragraph 2(l), for “the supervisory authority” (in both places) substitute “ the Commissioner ”.8In paragraph 2(m), for “the competent supervisory authority” substitute “ the Commissioner ”.9Omit paragraph 3.41Omit Article 48.421Article 49 is amended as follows.2In paragraph 1—ain the opening words, for “an adequacy decision pursuant to Article 45(3)” substitute “ adequacy regulations under section 17A of the 2018 Act ”;bin point (g), for “Union or Member State law” (in both places) substitute “ domestic law ”;cin the second subparagraph, for “the supervisory authority” substitute “ the Commissioner ”.3In paragraph 4, for “shall be recognised in Union law or in the law of the Member State to which the controller is subject” substitute “ must be public interest that is recognised in domestic law (whether in regulations under section 18(1) of the 2018 Act or otherwise) ”.4Omit paragraph 5.5After that paragraph insert—5AThis Article and Article 46 are subject to restrictions in regulations under section 18(2) of the 2018 Act..43In Article 50, for “the Commission and supervisory authorities” substitute “ the Commissioner ”.Chapter 6 (independent supervisory authorities)44For the heading of Chapter 6 substitute “ The Commissioner ”.451Article 51 is amended as follows.2For the heading, substitute “ Monitoring the application of this Regulation ”.3In paragraph 1—afor “Each Member State shall provide for one or more independent public authorities to be” substitute “ The Commissioner is ”;bomit “within the Union (“supervisory authority”)”.4Omit paragraphs 2, 3 and 4.461Article 52 is amended as follows.2In paragraph 1—afor “Each supervisory authority” substitute “ The Commissioner ”;bomit “its” (in both places).3In paragraph 2—afor “The member or members of each supervisory authority” substitute “ The Commissioner ”;bomit “their” (in both places).4In paragraph 3—afor “Member or members of each supervisory authority” substitute “ The Commissioner ”;bfor “their duties” substitute “ the Commissioner's duties ”;cfor “during their term of office” substitute “ while holding office ”.5Omit paragraphs 4, 5 and 6.47Omit Article 53.48Omit Article 54.49In the heading of section 2 of Chapter 6, for “Competence, tasks” substitute “ Tasks ”.50Omit Article 55.51Omit Article 56.521Article 57 is amended as follows.2In paragraph 1—afor “each supervisory authority shall on its territory” substitute “ the Commissioner must ”;bin point (c), for “, in accordance with Member State law, the national parliament” substitute “ Parliament ”;cin point (e), for “the supervisory authorities in other Member States” substitute “ foreign designated authorities ”;din point (f), for “another supervisory authority” substitute “ a foreign designated authority ”;eomit point (g);fin point (h), for “another supervisory authority” substitute “ a foreign designated authority ”;gin point (j), after “and” insert “ issue standard data protection clauses referred to ”;hafter point (o) insert—oamaintain a public register of certification mechanisms and data protection seals and marks pursuant to Article 42(8) and of controllers or processors established in third countries and certified pursuant to Article 42(7);;iomit point (t).3In paragraph 2, for “Each supervisory authority” substitute “ The Commissioner ”.4In paragraph 3, for “the tasks of each supervisory authority shall be” substitute “ the Commissioner's tasks is to be ”.5In paragraph 4, for “supervisory authority” (in both places) substitute “ Commissioner ”.531Article 58 is amended as follows.2In paragraph 1—afor “Each supervisory authority shall have” substitute “ The Commissioner has ”;bin point (e), for “its” substitute “the Commissioner's”;cin point (f), for “Union or Member State procedural law” substitute “ domestic law ”.3In paragraph 2, for “Each supervisory authority shall have” substitute “ The Commissioner has ”.4In paragraph 3—afor “Each supervisory authority shall have” substitute “ The Commissioner has ”;bin point (b)—ifor “its” substitute “the Commissioner's”;iifor “the national parliament, the Member State government or, in accordance with Member State law, to” substitute “ Parliament, the government or ”;comit point (c)5After paragraph 3 insert—3AIn the 2018 Act, section 115(4) to (9) provide that the Commissioner's functions under this Article are subject to certain safeguards..6Omit paragraphs 4, 5 and 6.54In Article 59—afor “Each supervisory authority” substitute “ The Commissioner ”;bfor “its” substitute “the Commissioner's”;cfor the second sentence substitute “ The Commissioner must arrange for those reports to be laid before Parliament and send a copy to the Secretary of State. ”;domit “, to the Commission and to the Board”.Chapter 7 (cooperation and consistency)55Omit Articles 60 to 76 and the headings for, and for the sections of, Chapter 7.Chapter 8 (remedies, liability and penalties)561Article 77 is amended as follows.2In the heading, for “a supervisory authority” substitute “ the Commissioner ”.3In paragraph 1, for “a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement” substitute “ the Commissioner ”.4In paragraph 2, for “The supervisory authority with which the complaint has been lodged” substitute “ The Commissioner ”.571Article 78 is amended as follows.2In the heading, for “a supervisory authority” substitute “ the Commissioner ”.3In paragraph 1, for “a supervisory authority” substitute “ the Commissioner ”.4In paragraph 2, for “the supervisory authority which is competent pursuant to Articles 55 and 56” substitute “ the Commissioner ”.5Omit paragraph 3.6Omit paragraph 4.581Article 79 is amended as follows.2In paragraph 1, for “a supervisory authority” substitute “ the Commissioner ”.3Omit paragraph 2.591Article 80 is amended as follows.2In paragraph 1—afor the words from “a not-for profit” to “their personal data” substitute “ a body or other organisation which meets the conditions in section 187(3) and (4) of the 2018 Act ”;bomit “where provided for by Member State law”.3In paragraph 2—afor “Member States” substitute “ The Secretary of State ”;bomit “, in that Member State,”;cfor “the supervisory authority which is competent pursuant to Article 77” substitute “ the Commissioner ”.4After that paragraph insert—3The Secretary of State may exercise the power under paragraph 2 of this Article only by making regulations under section 190 of the 2018 Act..60Omit Article 81.61In Article 82, omit paragraph 6.621Article 83 is amended as follows.2In paragraph 1, for “Each supervisory authority” substitute “ The Commissioner ”.3In paragraph 2—ain point (f), for “the supervisory authority” substitute “ the Commissioner ”;bin point (h), for “the supervisory authority” substitute “ the Commissioner ”.4In paragraph 4, for “10 000 000 EUR” substitute “ £8,700,000 ”.5In paragraph 5—afor “20 000 000 EUR” substitute “ £17,500,000 ”;bfor point (d) substitute—dany obligations under Part 5 or 6 of Schedule 2 to the 2018 Act or regulations made under section 16(1)(c) of the 2018 Act;;cin point (e), for “the supervisory authority” substitute “ the Commissioner ”.6In paragraph 6—afor “the supervisory authority” substitute “ the Commissioner ”;bfor “20 000 000 EUR” substitute “ £17,500,000 ”.7Omit paragraphs 7, 8 and 9.8After paragraph 9 insert—10In the 2018 Act, section 115(9) makes provision about the exercise of the Commissioner's functions under this Article..63In Article 84, for paragraphs 1 and 2 substitute—Part 6 of the 2018 Act makes further provision about penalties applicable to infringements of this Regulation..Chapter 9 (provisions relating to specific processing situations)641Article 85 is amended as follows.2Omit paragraph 1.3In paragraph 2—afor “Members States shall” substitute “ the Secretary of State may ”;bfor “independent supervisory authorities” substitute “ the Commissioner ”;comit “, Chapter VII (cooperation and consistency)”.4After that paragraph insert—2AThe Secretary of State may exercise the power under paragraph 2 of this Article only by making regulations under section 16 of the 2018 Act..5Omit paragraph 3.651Article 86 is amended as follows.2The existing text becomes paragraph 1.3In that paragraph, for “Union or Member State law” substitute “ domestic law ”.4After that paragraph insert—2Chapter 3 of Part 2 of the 2018 Act makes provision about the application of this Regulation to the manual unstructured processing of personal data held by an FOI public authority (as defined in Article 2)..66After Article 86 insert—Article 86A

Processing and national security and defence

Chapter 3 of Part 2 of the 2018 Act makes provision about the application of this Regulation where processing is carried out, or exemption from a provision of this Regulation is required, for the purposes of safeguarding national security or for defence purposes..67Omit Article 87.68Omit Article 88.691Article 89 is amended as follows.2After paragraph 1 insert—1AIn the 2018 Act, section 19 makes provision about when the requirements in paragraph 1 are satisfied..3Omit paragraphs 2, 3 and 4.70Omit Article 90.71Omit Article 91.Chapter 10 (delegated acts and implementing acts)72Omit Articles 92 and 93 and the heading for Chapter 10.Chapter 11 (final provisions)731Article 94 is amended as follows.2Omit paragraph 1.3In paragraph 2—ain the first sentence, for “the repealed Directive” substitute “ Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (which ceased to have effect on 25th May 2018) ”;bin the second sentence, for “by this Regulation” substitute “ by the EU GDPR (as defined in section 3 of the 2018 Act) ” .741Article 95 is amended as follows.2For “the Union” substitute “ the United Kingdom ”.3For “Directive 2002/58/EC” substitute “ domestic law made before IP completion day implementing Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ”.751Article 96 is amended as follows.2For “Member States” substitute “ the United Kingdom or the Commissioner ”.3For “Union law” substitute “ domestic law ”.76Omit Article 97.77Omit Article 98.78Omit Article 99.79Omit the sentence following Article 99.Supplementary80It is not to be presumed, by virtue of the revocation of a provision by this Schedule, that the provision was applicable to the United Kingdom immediately before IP completion day (and so would, but for this Schedule, be part of the UK GDPR).SCHEDULE 2Amendments of the Data Protection Act 2018 Regulation 4Introduction1The Data Protection Act 2018 is amended as follows.Part 1 (preliminary)21Section 1 is amended as follows.2In subsection (2), for “GDPR” substitute “ UK GDPR ”.3In subsection (3), for “GDPR” to the end substitute “ UK GDPR ”.4In subsection (4), omit “and implements the Law Enforcement Directive”.3In section 2(1) and (2), for “GDPR, the applied GDPR” substitute “ UK GDPR ”.41Section 3 is amended as follows.2In subsection (6), omit “Chapter 2 or 3 of” and “Chapter or”.3In subsection (9)—afor paragraph (a) substitute—athe UK GDPR,;bomit paragraph (b);cin paragraph (e), for “the GDPR” substitute “ the EU GDPR ”.4In subsection (10)—afor “The GDPR” substitute “ The UK GDPR ”;bfor “(General Data Protection Regulation)” substitute “ (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4) ) ”.5After subsection (10) insert—10A“The EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law..6Omit subsection (11).7In subsection (14)—afor paragraph (a) substitute—areferences to the UK GDPR are to the UK GDPR read with Part 2;;bomit paragraph (b);cin paragraphs (c) and (d), omit “Chapter 2 or 3 of”.Part 2 (general processing) (other than Schedules 1 to 6)51Section 4 is amended as follows.2In subsection (2)—afor “Chapter 2 of this Part” substitute “ This Part ”;bfor “GDPR” (in each place) substitute “ UK GDPR ”.3Omit subsection (3).61Section 5 is amended as follows.2In subsection (1)—aomit “Chapter 2 of”;bfor “GDPR” (in both places) substitute “ UK GDPR ”;cfor “Chapter 2 as” substitute “ this Part as ”.3In subsection (2)—afor “GDPR” (in each place) substitute “ UK GDPR ”;bfor “Chapter 2” substitute “ this Part ”.4In subsection (3), for “Chapter 2” substitute “ this Part ”.5Omit subsections (4), (5) and (6).6In subsection (7)—aomit “Chapter 2 or Chapter 3 of”;bfor “the Chapter” substitute “ this Part ”.7For the heading of Chapter 2 substitute “ The UK GDPR ”.8In the italic heading before section 6, for “GDPR” substitute “ UK GDPR ”.9In section 6(1) and (2), for “GDPR” substitute “ UK GDPR ”.101Section 7 is amended as follows.2In subsection (1)—afor “GDPR” substitute “ UK GDPR ”;bomit “under the law of the United Kingdom”.3In subsections (2) and (4), for “GDPR” substitute “ UK GDPR ”.11In section 8, for “GDPR” substitute “ UK GDPR ”.12Omit section 9.131Section 10 is amended as follows.2In subsections (1), (2) and (3), for “GDPR” substitute “ UK GDPR ”.3In subsection (5), for “10 of the GDPR” substitute “ 10(1) of the UK GDPR ”.14In section 11, in subsection (1) (in both places) and in subsection (2), for “GDPR” substitute “ UK GDPR ”.15In section 12(1)(a) and (b), for “GDPR” substitute “ UK GDPR ”.16In section 13(2) and (3), for “GDPR” substitute “ UK GDPR ”.171Section 14 is amended as follows.2In subsection (1)—afor “GDPR” (in both places) substitute “ UK GDPR ”;bfor “authorised by law” substitute “ required or authorised under the law of the United Kingdom or a part of the United Kingdom ”.3In subsections (3)(c), (5) and (6) (in both places), for “GDPR” substitute “ UK GDPR ”.18For the italic heading before section 15 substitute “ Exemptions etc ”.191Section 15 is amended as follows.2In subsection (1), for “GDPR” substitute “ UK GDPR ”.3In subsection (2)(a)—afor “GDPR” (in the first place) substitute “ UK GDPR ”;bfor “, as allowed for by” substitute “ (of a kind described in ”;cfor “GDPR” (in the second place) substitute “ UK GDPR) ”.4In subsection (2)(b)—afor “GDPR” (in the first place) substitute “ UK GDPR ”;bfor “, as allowed for by” substitute “ (of a kind described in ”;cfor “GDPR” (in the second place) substitute “ UK GDPR) ”.5In subsection (2)(c)—afor “GDPR” (in the first place) substitute “ UK GDPR ”;bfor “, as allowed for by” substitute “ (of a kind described in ”;cfor “GDPR” (in the second place) substitute “ UK GDPR) ”.6In subsection (2)(d)—afor “GDPR” (in the first place) substitute “ UK GDPR ”;bfor “, as allowed for by” substitute “ (of a kind described in ”;cfor “GDPR” (in the second place) substitute “ UK GDPR) ”.7In subsection (2)(e)—afor “, V and VII of the GDPR” substitute “ and V of the UK GDPR ”;bfor “, as allowed for by Article 85(2) of the GDPR” substitute “ (of a kind described in Article 85(2) of the UK GDPR) ”.8In subsection (2)(f)—afor “GDPR” (in the first place) substitute “ UK GDPR ”;bomit “, as allowed for by Article 89(2) and (3) of the GDPR”.9In subsection (3)—afor “GDPR” (in the first place) substitute “ UK GDPR ”;bfor “, as allowed for by” substitute “ (of a kind described in ”;cfor “GDPR” (in the second place) substitute “ UK GDPR) ”.10In subsection (4) —afor “GDPR” (in the first place) substitute “ UK GDPR ”;bfor “, as allowed for by” substitute “ (of a kind described in ”;cfor “GDPR” (in the second place) substitute “ UK GDPR) ”.11After subsection (4) insert—4AIn connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25)..12In subsection (5), for “and the exemption in section 26” substitute “ (sections 26 to 28) ”.201Section 16 is amended as follows.2In subsection (1)—ain the opening words, for “GDPR” substitute “ UK GDPR ”;bin paragraph (a)—iomit “for Member State law”;iifor “GDPR” substitute “ UK GDPR ”;cin paragraph (b), for “a legislative measure” substitute “ provision ”;din paragraph (c), for “GDPR” substitute “ UK GDPR ”.3In subsection (2)—aomit “and” at the end of paragraph (a)(ii);bafter paragraph (b) insert—, andcconsequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section..21For the italic heading before section 17 substitute “ Certification ”.221Section 17 is amended as follows.2In subsection (1)(b), for “national accreditation body” substitute “ UK national accreditation body ”.3In subsection (3), for “national accreditation body” substitute “ UK national accreditation body ”.4In subsection (6)—afor “national accreditation body” substitute “ UK national accreditation body ”;bfor “GDPR” substitute “ UK GDPR ”.5In subsection (7)—afor “national accreditation body” substitute “ UK national accreditation body ”;bfor “GDPR” substitute “ UK GDPR ”.6In subsection (8)—afor “GDPR” substitute “ UK GDPR ”;bfor “national accreditation body” (in both places) substitute “ UK national accreditation body ”.23Before section 18 (but after the italic heading before it) insert—Transfers based on adequacy regulations17A1The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—aa third country,ba territory or one or more sectors within a third country,can international organisation, orda description of such a country, territory, sector or organisation.2For the purposes of the UK GDPR and this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—ain the case of a third country, the country or a relevant territory or sector within the country, orbin the case of an international organisation, the organisation.3Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).4Article 45(2) of the UK GDPR makes provision about the assessment of the adequacy of the level of protection for the purposes of this section and section 17B.5Regulations under this section—awhere they relate to a third country, must specify their territorial and sectoral application;bwhere applicable, must specify the independent supervisory authority or authorities referred to in Article 45(2)(b) of the UK GDPR.6Regulations under this section may, among other things—aprovide that in relation to a country, territory, sector, organisation or transfer specified, or falling within a description specified, in the regulations, section 17B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;bidentify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;cconfer a discretion on a person.7Regulations under this section are subject to the negative resolution procedure.Transfers based on adequacy regulations: review etc17B1For so long as regulations under section 17A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.2Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.3The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 17A or to amend or revoke such regulations.4Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 17A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.5Where regulations under section 17A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.6The Secretary of State must publish—aa list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 17A, andba list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.7In the case of regulations under section 17A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—athe duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, andbthe lists published under subsection (6) must specify or describe the relevant transfers.Standard data protection clauses17C1The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 119A).2The Secretary of State must keep under review the standard data protection clauses specified in regulations under this section that are for the time being in force.3Regulations under this section are subject to the negative resolution procedure..241Section 18 is amended as follows.2In the heading, at the end insert “ : public interest ”.3In subsection (1), for “GDPR” substitute “ UK GDPR ”.4In subsection (2), for paragraph (a) (but not the final “and”) substitute—athe transfer cannot take place based on adequacy regulations (see section 17A),.25In section 19(2), for “GDPR” substitute “ UK GDPR ”.26In section 20—afor “this Chapter” (in both places) substitute “ this Part ”;bfor “GDPR” substitute “ UK GDPR ”.27For the heading of Chapter 3 substitute “ Exemptions for manual unstructured processing and for national security and defence purposes ”.28For the italic heading before section 21 substitute “ Definitions ”.291Section 21 is amended as follows.2For the heading substitute “ Definitions ”.3Omit subsections (1), (2), (3) and (4).30Omit section 22 and the italic heading before it.31Omit section 23.321Section 24 is amended as follows.2In subsection (1)—afor “the applied GDPR” substitute “ the UK GDPR ”;bfor “this Chapter” substitute “ the UK GDPR ”;cfor “section 21(2)” substitute “ Article 2(1A) ”.3In subsection (2)—ain paragraphs (a), (b) and (c), for “the applied GDPR” substitute “ the UK GDPR ”;bafter paragraph (c) insert—cain Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);cbin Part 5 of this Act, section 119A (standard clauses for transfers to third countries);;cfor paragraph (d) substitute—din Part 7 of this Act, sections 170 and 171 (offences relating to personal data)..4In subsection (3)—afor “the applied GDPR” substitute “ the UK GDPR ”;bfor “this Chapter” substitute “ the UK GDPR ”;cfor “section 21(2)” substitute “ Article 2(1A) ”.5In subsection (5)—afor “the applied GDPR” substitute “ the UK GDPR ”;bfor “this Chapter” substitute “ the UK GDPR ”;cfor “section 21(2)” substitute “ Article 2(1A) ”;din paragraph (a), for “that Article” substitute “ Article 15 ”.331Section 25 is amended as follows.2In subsection (1)—afor “the applied GDPR” substitute “ the UK GDPR ”;bfor “this Chapter” substitute “ the UK GDPR ”;cfor “section 21(2)” substitute “ Article 2(1A) ”.3In subsection (2)(a) and (b), omit “of the applied GDPR”.341Section 26 is amended as follows.2In subsection (1)—afor “the applied GDPR” substitute “ the UK GDPR ”;bfor “this Chapter” substitute “ the UK GDPR ”.3In subsection (2)—ain paragraphs (a), (b), (c) and (d), for “the applied GDPR” substitute “ the UK GDPR ”;bin paragraph (e), for “the applied GDPR” (in both places) substitute “ the UK GDPR ”;cin paragraph (f), for “the applied GDPR” substitute “ the UK GDPR ”;dafter paragraph (f) insert—fain Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);;ein paragraph (g)—iin sub-paragraph (ii), for “the applied GDPR” substitute “ the UK GDPR ”;iiafter sub-paragraph (iii) insert—ivsection 119A (standard clauses for transfers to third countries);.35In section 27(5), for “the applied GDPR” substitute “ the UK GDPR ”.361Section 28 is amended as follows.2In the heading, for “applied GDPR” substitute “ UK GDPR ”.3In subsections (1) and (2)—afor “the applied GDPR” substitute “ the UK GDPR ”;bfor “this Chapter” substitute “ the UK GDPR ”.4In subsection (3), for “the applied GDPR” substitute “ the UK GDPR ”.5After subsection (4) insert—5The functions conferred on the Commissioner in relation to the UK GDPR by Articles 57(1)(a), (d), (e), (h) and (u) and 58(1)(d) and (2)(a) to (d) of the UK GDPR (which are subject to safeguards set out in section 115) include functions in relation to subsection (3)..Part 3 (law enforcement processing) (other than Schedules 7 and 8)37In section 33(7), for “other than a member State” substitute “ outside the United Kingdom ”.38In section 48, omit subsection (8).39In section 67, omit subsection (8).401Section 73 is amended as follows.2In subsection (1)(b), omit “other than the United Kingdom”.3In subsection (3)—ain paragraph (a) for “an adequacy decision (see section 74)” substitute “ adequacy regulations (see section 74A) ”;bin paragraphs (b) and (c), for “an adequacy decision” substitute “ adequacy regulations ”.4In subsection (5)(a), omit “a member State or”.41Omit section 74.42After section 74 insert—Transfers based on adequacy regulations74A1The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—aa third country,ba territory or one or more sectors within a third country,can international organisation, orda description of such a country, territory, sector or organisation.2For the purposes of this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—ain the case of a third country, the country or a relevant territory or sector within the country, andbin the case of an international organisation, the organisation,and such a transfer does not require specific authorisation.3Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).4When assessing the adequacy of the level of protection for the purposes of this section or section 74B, the Secretary of State must, in particular, take account of—athe rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation, which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data is transferred,bthe existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with data protection rules, including adequate enforcement powers, for assisting and advising data subjects in exercising their rights and for cooperation with the Commissioner, andcthe international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.5Regulations under this section—awhere they relate to a third country, must specify their territorial and sectoral application;bwhere applicable, must specify the independent supervisory authority or authorities referred to in subsection (4)(b).6Regulations under this section may, among other things—aprovide that, in relation to a country, territory, sector, organisation or territory specified, or falling within a description specified, in the regulations, section 74B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;bidentify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;cconfer a discretion on a person.7Regulations under this section are subject to the negative resolution procedure.Transfers based on adequacy regulations: review etc74B1For so long as regulations under section 74A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.2Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.3The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 74A or to amend or revoke such regulations.4Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 74A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.5Where regulations under section 74A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.6The Secretary of State must publish—aa list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 74A, andba list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.7In the case of regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—athe duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, andbthe lists published under subsection (6) must specify or describe the relevant transfers..43In section 76(1)(c), omit “a member State or”.44Section 77(8), for “member States” substitute “ the United Kingdom ”.451Section 78 is amended as follows.2In subsection (4), omit “other than the United Kingdom”.3In subsection (5)(a), omit “a member State or”.461Section 80 is amended as follows.2In subsection (1), for “an EU recipient or a non-EU recipient” substitute “ a non-UK recipient ”.3In subsection (2)—aomit the definition of “EU recipient”;bfor “non-EU recipient” substitute “ non-UK recipient ”.4In subsection (4), for “the EU recipient or non-EU recipient” substitute “ the non-UK recipient ”.5Omit subsections (5), (6) and (7).Part 5 (Information Commissioner) (other than Schedules 12 to 14)471Section 115 is amended as follows.2In the heading, for “GDPR” substitute “ UK GDPR ”.3Omit subsection (1).4In subsection (2)—ain paragraphs (a) and (b), for “GDPR” substitute “ UK GDPR ”;bafter “section 2” insert “ and section 28(5) ”.5In subsections (3) and (4), for “GDPR” substitute “ UK GDPR ”.6In subsection (5), for “GDPR” (in both places) substitute “ UK GDPR ”.7In subsection (6), for “GDPR” substitute “ UK GDPR ”.8In subsection (7), for “GDPR” (in both places) substitute “ UK GDPR ”.9In subsection (8)(a) and (b), for “GDPR” substitute “ UK GDPR ”.10In subsections (9) and (10), for “GDPR” substitute “ UK GDPR ”.481Section 116 is amended as follows.2Before subsection (1) insert—A1The Commissioner is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals in relation to processing by a competent authority for any of the law enforcement purposes (as defined in Part 3) and to facilitate the free flow of personal data..3In subsection (1), omit paragraph (a) (including the final “and”).4In subsection (2), for “GDPR” substitute “ UK GDPR ”.491Section 117 is amended as follows.2After “this Act” insert “ or the UK GDPR ”.3Omit “(and see also Article 55(3) of the GDPR)” (and the comma before those words).501Section 118 is amended as follows.2For the heading substitute “ Co-operation between parties to the Data Protection Convention ”.3Omit subsections (1), (2), (3) and (4).51After section 119 insert—Standard clauses for transfers to third countries etc119A1The Commissioner may issue a document specifying standard data protection clauses which the Commissioner considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 17C).2The Commissioner may issue a document that amends or withdraws a document issued under subsection (1).3A document issued under this section—amust specify when it comes into force,bmay make different provision for different purposes, andcmay include transitional provision or savings.4Before issuing a document under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—atrade associations;bdata subjects;cpersons who appear to the Commissioner to represent the interests of data subjects.5After a document is issued under this section—athe Commissioner must send a copy to the Secretary of State, andbthe Secretary of State must lay it before Parliament.6If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR).7Nothing in subsection (6)—aaffects any transfer of personal data previously made in reliance on the document, orbprevents a further document being laid before Parliament.8The Commissioner must publish—aa document issued under this section, andba notice identifying any document which, under subsection (6), is treated as not having been issued under this section.9The Commissioner must keep under review the clauses specified in a document issued under this section for the time being in force.10In this section, “the 40-day period” means—aif the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, orbif the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.11In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.12In this section, “trade association” includes a body representing controllers or processors..521Section 120 is amended as follows.2In subsection (2), for “GDPR” (in each place) substitute “ UK GDPR ”.3After subsection (2) insert—2AThe Commissioner may contribute to the activities of international organisations with data protection functions..4In subsection (6), in the definition of “third country”, for “that is not a member State” substitute “ outside the United Kingdom ”.53In section 123(7), for “GDPR” (in both places) substitute “ UK GDPR ”.54In section 129(1), for “GDPR” substitute “ UK GDPR ”.55In section 132(2), omit paragraph (d).56In section 135(4), for “GDPR” substitute “ UK GDPR ”.57In section 136(1)(b), for “GDPR” substitute “ UK GDPR ”.58In section 139(2), for “GDPR” substitute “ UK GDPR ”.Part 6 (enforcement) (other than Schedules 15 to 17)59In section 142(9)—afor “GDPR” (in both places) substitute “ UK GDPR ”;bfor “the European Union” substitute “ the United Kingdom ”.60In section 143(9), for “GDPR” substitute “ UK GDPR ”.61In section 149(2)(a), (b), (c) and (e), (3) and (4)(b) and (c), for “GDPR” substitute “ UK GDPR ”.62In section 151(1)(b) and (8)(a), for “GDPR” substitute “ UK GDPR ”.63In section 155(2)(a), for “GDPR” (in both places) substitute “ UK GDPR ”.641Section 157 is amended as follows.2In subsection (1), for “GDPR” (in both places) substitute “ UK GDPR ”;3In subsection (2)(a), omit “74,”.4In subsection (5), for “20 million Euros” (in both places) substitute “ £17,500,000 ”.5In subsection (6), for “10 million Euros” (in both places) substitute “ £8,700,000 ”.6Omit subsection (7).65In section 159(1) and (2), for “GDPR” substitute “ UK GDPR ”.661Section 165 is amended as follows.2In subsection (1), for “GDPR” (in both places) substitute “ UK GDPR ”.3In subsection (5)(b), for “another supervisory authority or” substitute “ a ”.4Omit subsection (6).5In subsection (7), omit the definition of “supervisory authority”.67In section 166(1), for “GDPR” substitute “ UK GDPR ”.68In section 167(4), for “GDPR” substitute “ UK GDPR ”.691Section 168 is amended as follows.2In the heading, for “GDPR” substitute “ UK GDPR ”.3In subsections (1) and (2), for “GDPR” substitute “ UK GDPR ”.70In section 169(1), for “GDPR” substitute “ UK GDPR ”.71In section 170(7), for “GDPR” substitute “ UK GDPR ”.72In section 171(8)(a), for “GDPR” substitute “ UK GDPR ”.73In section 173(2)(a) and (b), for “GDPR” substitute “ UK GDPR ”.74In section 174(2)(a) and (b), for “GDPR” substitute “ UK GDPR ”.75In section 180(2)(d) and (e), for “GDPR” substitute “ UK GDPR ”.76In section 181, in the definition of “representative”, for “GDPR” (in both places) substitute “ UK GDPR ”.Part 7 (supplementary and final provision) (other than Schedules 18 to 20)77In section 182(3), omit paragraph (a).781Section 183 is amended as follows.2In subsection (2)(d), for “processing of personal data to which Chapter 3 of Part 2 or Part 4 of this Act applies” substitute “ relevant processing of personal data ”.3After subsection (2) insert—2AIn subsection (2)(d), “relevant processing of personal data” means—aprocessing of personal data described in Article 2(1)(a) or (b) or (1A) of the UK GDPR, andbprocessing of personal data to which Part 4 of this Act applies..79In section 185(4)(a) and (b), for “GDPR” substitute “ UK GDPR ”.801Section 186 is amended as follows.2In subsection (2)(a), for “GDPR” substitute “ UK GDPR ”.3In subsection (3)(b), omit “23,”.811Section 187 is amended as follows.2In subsection (1), in the opening words, for “GDPR applies” insert “ UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects) ”.3In subsection (1)(a)—aomit “Article 80(1) of the GDPR (representation of data subjects)”;bfor “that Article” substitute “ subsections (3) and (4) ”;cfor “GDPR” (in the second place) substitute “ UK GDPR ”.4In subsection (1)(b)—afor “a data subject may also authorise” substitute “ also authorises ”;bfor “GDPR” substitute “ UK GDPR ”.5In subsection (2)—afor “GDPR” substitute “ UK GDPR ”;bin paragraph (a), for “, (4)(d) and (6)(c)” substitute “ and (4)(d) ”.6In subsection (5), for “GDPR” substitute “ UK GDPR ”.82In section 188(2), for “GDPR” substitute “ UK GDPR ”.831Section 189 is amended as follows.2In subsection (2), for “GDPR” (in each place) substitute “ UK GDPR ”.3In subsection (4)(c) and (d), for “GDPR” substitute “ UK GDPR ”.84In section 190(1), for “GDPR” (in each place) substitute “ UK GDPR ”.851Section 205 is amended as follows.2In subsection (1), in the definition of “enactment”—aomit “and” at the end of paragraph (d);bafter paragraph (e) insert—andfany retained direct EU legislation;.3In subsection (1), in the definition of “international obligation of the United Kingdom”, omit paragraph (a).4After subsection (1) insert—1AIn this Act, references to a fundamental right or fundamental freedom (however expressed) are to a fundamental right or fundamental freedom which continues to form part of domestic law on and after IP completion day by virtue of section 4 of the European Union (Withdrawal) Act 2018, as the right or freedom is amended or otherwise modified by the law of the United Kingdom, or of a part of the United Kingdom, from time to time on or after IP completion day..5In subsection (2)—abefore paragraph (a) insert—zasection 119A(10) and (11);;bomit “Chapter 2 or 3 of”.6Omit subsection (3).7After subsection (3) insert—4In the definition of “the UK GDPR” in section 3(10)—athe reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“the 2019 Regulations”), butbnothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified.5Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other retained EU law are to be interpreted..861The Table in section 206 is amended as follows.2Omit the entries for “the applied Chapter 2” and “the applied GDPR”.3After the entry for “enforcement notice” insert—the EU GDPRsection 3.4Omit the entry for “the GDPR”.5In the entries for “public authority” and “public body”, for “GDPR” substitute “ UK GDPR ”.6At the end insert—the UK GDPRsection 3.871Section 207 is amended as follows.2In subsection (1), for “(2) and (3)” substitute “ (1A) and (2) ”.3After subsection (1) insert—1AIn the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR..4In subsection (2), for “It applies to the processing of personal data” substitute “ In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out ”.5Omit subsection (3).6In subsection (4), for “Subsections (1) to (3)” substitute “ Subsections (1), (1A) and (2) ”.7Omit subsection (6).8In subsection (7), omit the words after paragraph (d).88In section 209(2), (3) and (4), for “GDPR” substitute “ UK GDPR ”.89In section 210(2) and (3), for “GDPR” substitute “ UK GDPR ”.901Section 213 is amended as follows.2In subsection (2), for “GDPR” substitute “ EU GDPR ”.3At the end insert—4Schedule 21 contains further transitional, transitory and saving provision made in connection with the amendment of this Act and the UK GDPR by regulations under section 8 of the European Union (Withdrawal) Act 2018..Schedules911Schedule 1 is amended as follows.2In paragraph 2(3), for “GDPR” substitute “ UK GDPR ”.3In paragraph 4(b), for “GDPR” substitute “ UK GDPR ”.4In paragraph 39(a), for “GDPR” substitute “ UK GDPR ”.5In paragraph 41, for “GDPR” (in both places) substitute “ UK GDPR ”.921Schedule 2 is amended as follows.2In the heading, for “GDPR” substitute “ UK GDPR ”.3In the heading of Part 1, for “based on” substitute “ as described in ”.4In the italic heading before paragraph 1, for “GDPR” (in the first place) substitute “ UK GDPR ”.5In paragraph 1—ain sub-paragraph (a), for “GDPR” (in both places) substitute “ UK GDPR ”;bin sub-paragraph (b), for “GDPR” (in both places) substitute “ UK GDPR ”.6In paragraph 2—ain sub-paragraph (1), for “GDPR” (in the second place) substitute “ UK GDPR ”;bin sub-paragraph (3), for “GDPR” substitute “ UK GDPR ”.7In paragraph 3—ain sub-paragraph (1), for “GDPR” substitute “ UK GDPR ”;bin sub-paragraph (3), for “GDPR” (in each place) substitute “ UK GDPR ”.8In paragraph 4—ain sub-paragraph (1), for “GDPR” substitute “ UK GDPR ”;bin sub-paragraph (2), in the opening words (but not the words following paragraph (g)), for “GDPR” (in each place) substitute “ UK GDPR ”;cin sub-paragraph (4), for “GDPR” substitute “ UK GDPR ”.9In the heading of Part 2, for “based on” substitute “ as described in ”.10In the italic heading before paragraph 6, for “GDPR” (in the first place) substitute “ UK GDPR ”.11In paragraph 6, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.12In paragraph 13, for “GDPR” (in the second place) substitute “ UK GDPR ”.13In the heading of Part 3, for “based on Article 23(1):” substitute “ for the ”.14In paragraph 16(1), for “GDPR” (in both places) substitute “ UK GDPR ”.15In the heading of Part 4, for “based on” substitute “ as described in ”.16In the italic heading before paragraph 18, for “GDPR” (in the first place) substitute “ UK GDPR ”.17In paragraph 18, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.18In paragraph 20(3), for “GDPR” substitute “ UK GDPR ”.19In paragraph 25—ain sub-paragraph (2), for “GDPR” (in both places) substitute “ UK GDPR ”;bin sub-paragraph (3), for “GDPR” substitute “ UK GDPR ”.20In the heading of Part 5, omit “based on Article 85(2)”.21In paragraph 26(9)—ain the opening words, for “GDPR” (in the second and third places) substitute “ UK GDPR ”;bin paragraphs (a), (b), (c) and (d), for “GDPR” substitute “ UK GDPR ”;comit paragraph (e).22In the heading of Part 6, omit “based on Article 89”.23In paragraph 27—ain sub-paragraph (1), for “sub-paragraph (3)” substitute “ sub-paragraphs (3) and (4) ”;bin sub-paragraph (2), for “GDPR (the rights in which may be derogated from by virtue of Article 89(2) of the GDPR)” substitute “ UK GDPR ”;cin sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;dafter sub-paragraph (3) insert—4Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph..24In paragraph 28—ain sub-paragraph (1), for “sub-paragraph (3)” substitute “ sub-paragraphs (3) and (4) ”;bin sub-paragraph (2), for “GDPR (the rights in which may be derogated from by virtue of Article 89(3) of the GDPR)” substitute “ UK GDPR ”;cin sub-paragraph (3), for “GDPR” substitute “ UK GDPR ”;dafter sub-paragraph (3) insert—4Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph..931Schedule 3 is amended as follows.2In the heading, for “GDPR” substitute “ UK GDPR ”.3In the heading of Part 1, for “GDPR” substitute “ UK GDPR ”.4In paragraph 1, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.5In paragraph 2(2), for “GDPR” substitute “ UK GDPR ”.6In the italic heading before paragraph 5, for “GDPR” substitute “ UK GDPR ”.7In paragraph 5(1), for “GDPR” substitute “ UK GDPR ”.8In the italic heading before paragraph 6, for “GDPR” substitute “ UK GDPR ”.9In paragraph 6(1), for “GDPR” substitute “ UK GDPR ”.10In paragraph 7(2), for “GDPR” substitute “ UK GDPR ”.11In the italic heading before paragraph 11, for “GDPR” substitute “ UK GDPR ”.12In paragraph 11, for “GDPR” substitute “ UK GDPR ”.13In the italic heading before paragraph 12, for “GDPR” substitute “ UK GDPR ”.14In paragraph 12(1)(a) and (3), for “GDPR” substitute “ UK GDPR ”.15In paragraph 17(2), for “GDPR” substitute “ UK GDPR ”.16In the italic heading before paragraph 19, for “GDPR” substitute “ UK GDPR ”.17In paragraph 19, for “GDPR” substitute “ UK GDPR ”.18In the italic heading before paragraph 20, for “GDPR” substitute “ UK GDPR ”.19In paragraph 20(1)(a) and (3), for “GDPR” substitute “ UK GDPR ”.20In the italic heading before paragraph 21, for “GDPR” substitute “ UK GDPR ”.21In paragraph 21(2), for “GDPR” substitute “ UK GDPR ”.941Schedule 4 is amended as follows.2In the heading, for “GDPR” substitute “ UK GDPR ”.3In the italic heading before paragraph 1, for “GDPR” (in the first place) substitute “ UK GDPR ”.4In paragraph 1, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.95In Schedule 5, in the following provisions, for “national accreditation body” substitute “ UK national accreditation body ”aparagraph 1(2) (in both places);bparagraph 4(4) (in both places);cparagraph 6(4).96Omit Schedule 6.971Schedule 13 is amended as follows.2In paragraph 1(1)—ain paragraph (e), omit “LED supervisory authorities and”;bin paragraph (f), omit “LED supervisory authorities and” and “the Law Enforcement Directive and”;cin paragraph (g), omit “an LED supervisory authority,”;domit paragraph (i).3In paragraph 3, omit the definition of “LED supervisory authority”.98In Schedule 14, omit Part 1.991Schedule 18 is amended as follows.2In paragraph 1(2), for “section 21(2)” substitute “ Article 2(1A) of the UK GDPR ”.3In paragraph 5(a) and (b), for “GDPR” substitute “ UK GDPR ”.1001Schedule 19 is amended as follows.2In paragraph 431(3), for “the GDPR or the applied GDPR” substitute “ the UK GDPR ”.3In paragraph 432(5)(a), for “the GDPR or the applied GDPR” substitute “ the UK GDPR ”.1011Schedule 20 is amended as follows.2In the heading of Part 3, for “GDPR” substitute “ UK GDPR ”.3In the italic heading before paragraph 12, for “GDPR” (in both places) substitute “ UK GDPR ”.4In paragraph 18—ain sub-paragraphs (2)(b) and (6)(b), for “applied GDPR” substitute “ UK GDPR ”;bafter sub-paragraph (7) insert—8In this paragraph, references to the UK GDPR do not include the EU GDPR as it was directly applicable to the United Kingdom before IP completion day (see paragraph 2 of Schedule 21)..5In paragraph 50, for “GDPR” substitute “ UK GDPR ”.102After Schedule 20 insert—SCHEDULE 21Further transitional provision etc Section 213Part 1InterpretationThe applied GPDR1In this Schedule, “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.Part 2Continuation of existing acts etcMerger of the directly applicable GDPR and the applied GDPR21On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include—athe EU GDPR as it was directly applicable to the United Kingdom before IP completion day, read with Chapter 2 of Part 2 of this Act as it had effect before IP completion day, andbthe applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before IP completion day.2On and after IP completion day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before IP completion day.3Sub-paragraphs (1) and (2) have effect—ain relation to references in this Act, except as otherwise provided;bin relation to references in other enactments, unless the context otherwise requires.31Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act—aif in force or effective immediately before IP completion day, continues to be in force or effective on and after IP completion day, andbif in the process of being done immediately before IP completion day, continues to be done on and after IP completion day.2References in this paragraph to anything done include references to anything omitted to be done.Part 3Transfers to third countries and international organisationsUK GDPR: adequacy decisions and adequacy regulations41On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—ain the case of a third country, the country or a relevant territory or sector within the country, orbin the case of an international organisation, the organisation.2Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).3The Secretary of State may by regulations—arepeal sub-paragraphs (1) and (2) and paragraph 5;bamend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;camend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).4Regulations under this paragraph may, among other things——aidentify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;bconfer a discretion on a person.5Regulations under this paragraph are subject to the negative resolution procedure.6Sub-paragraphs (1) and (2) have effect in addition to section 17A(2) and (3).51The following are specified for the purposes of paragraph 4(1)—aan EEA state;bGibraltar;ca Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;dan equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;ea third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended;fa third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended.2The decisions mentioned in sub-paragraph (1)(e) are the following—aCommission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;bCommission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;cCommission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina;dCommission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey;eCommission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man;fCommission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey;gCommission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;hCommission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra;iCommission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;jCommission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;kCommission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;l. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .mCommission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information. 3Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).4The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6). 5For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.6For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—atransfers from the European Union (or the European Community) or the European Economic Area, orbtransfers to which the EU GDPR applies,it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).61In the provisions listed in sub-paragraph (2)—areferences to regulations made under section 17A (other than references to making such regulations) include the provision made in paragraph 5;breferences to the revocation of such regulations include the repeal of all or part of paragraph 5.2Those provisions are—aArticles 13(1)(f), 14(1)(f), 45(1) and (7), 46(1) and 49(1) of the UK GDPR;bsections 17B(1), (3), (6) and (7) and 18(2) of this Act.UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses71Subject to paragraph 8, the appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described in this paragraph.2The safeguards may be provided for by any standard data protection clauses included in an arrangement which, if the arrangement had been entered into immediately before IP completion day, would have provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.3The safeguards may be provided for by a version of standard data protection clauses described in sub-paragraph (2) incorporating changes where—aall of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), andbnone of the changes alters the effect of the clauses.4The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—achanging references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;bchanging references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.5In the case of a transfer of personal data made under arrangements entered into before IP completion day, the safeguards may be provided for on and after IP completion day by standard data protection clauses not falling within sub-paragraph (2) which—aformed part of the arrangements immediately before IP completion day, andbat that time, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.6The Secretary of State and the Commissioner must keep the operation of this paragraph under review.7In this paragraph, “adequacy decision” means a decision made on the basis of—aArticle 45(3) of the EU GDPR, orbArticle 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.8This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.81Paragraph 7 does not apply to the extent that it has been disapplied by—aregulations made by the Secretary of State, orba document issued by the Commissioner.2Regulations under this paragraph are subject to the negative resolution procedure.3Subsections (3) to (8) and (10) to (12) of section 119A apply in relation to a document issued by the Commissioner under this paragraph as they apply to a document issued by the Commissioner under section 119A(2).UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules91The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described sub-paragraphs (2) to (4), subject to sub-paragraph (5).2The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.3The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—aall of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), andbnone of the changes alters the effect of the rules.4The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—achanging references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;bchanging references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.5Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)). 5AFor the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—aa valid notification of the rules has been made to the Commissioner,bthe Commissioner has approved them, andcthat approval has not been withdrawn.5BA notification is valid if it—ais made by a controller or processor established in the United Kingdom,bis made to the Commissioner before the end of the period of 6 months beginning with IP completion day, andcincludes—ithe name and contact details of the data protection officer or other contact point for the controller or processor, andiisuch other information as the Commissioner may reasonably require.5CWhere a valid notification is made the Commissioner must, without undue delay—adecide whether or not to approve the rules, andbnotify the controller or processor of that decision. 6The Commissioner must keep the operation of this paragraph under review.7In this paragraph—“adequacy decision” means a decision made on the basis of—Article 45(3) of the EU GDPR, orArticle 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;“binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR.8This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.Part 3 (law enforcement processing): adequacy decisions and adequacy regulations101On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—ain the case of a third country, the country or a relevant territory or sector within the country, orbin the case of an international organisation, the organisation.2Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).3The Secretary of State may by regulations—arepeal sub-paragraphs (1) and (2) and paragraph 11;bamend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;camend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).4Regulations under this paragraph may, among other things—aidentify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;bconfer a discretion on a person.5Regulations under this paragraph are subject to the negative resolution procedure.6Sub-paragraphs (1) and (2) have effect in addition to section 74A(2) and (3).111The following are specified for the purposes of paragraph 10(1)—a an EEA state; aaSwitzerland;bGibraltar;ca third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended.2Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).3The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5).4For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.5For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—atransfers from the European Union (or the European Community) or the European Economic Area, orbtransfers to which the Law Enforcement Directive applies,it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).12In section 74B(1), (3), (6) and (7)—areferences to regulations made under section 74A (other than references to making such regulations) include the provision made in paragraph 11;breferences to the revocation of such regulations include the repeal of all or part of paragraph 11.Part 4Repeal of provisions in Chapter 3 of Part 2Applied GDPR: power to make provision in consequence of GDPR regulations131Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.2The provisions listed in section 186(3) include regulations made under section 23 before IP completion day (and not revoked).3Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland.Applied GDPR: national security certificates141This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day.2A reference in the certificate to a provision of the applied GDPR has effect, on and after IP completion day, as it if were a reference to the corresponding provision of the UK GDPR or this Act.Part 5The Information CommissionerConfidentiality of information15The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after IP completion day.Part 6EnforcementGDPR: maximum amount of penalties16In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR—aArticle 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “ 20 million Euros ”;bArticle 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “ 10 million Euros ”;cthe maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act.GDPR: right to an effective remedy against the Commissioner171This paragraph applies where—aproceedings are brought against a decision made by the Commissioner before IP completion day, andbthe Commissioner's decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR.2The Commissioner must forward the Board's opinion or decision to the court or tribunal dealing with the proceedings..SCHEDULE 3Consequential amendments of other legislation Regulation 6PART 1Revocation of retained EU lawRevocation of Regulations and Decisions1The following Regulations and Decisions are revoked in so far as they are retained EU law—aCommission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;aaCommission Decision 2000/519/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Hungary;bCommission Decision 2001/497/EC of 15th June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC;cCommission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;dCommission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina;eCommission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey;fCommission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man;faCouncil Decision 2004/644/EC of 13th September 2004 adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;gCommission Decision 2004/915/EC of 27th December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries;hCommission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey;haCommission Decision 2008/597/EC of 3rd June 2008 adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;iCommission Decision 2010/87/EU of 5th February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council;jCommission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;kCommission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra;lCommission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;mCommission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;nCommission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;oCommission Implementing Decision (EU) 2016/1250 of 12th July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield;pCommission Implementing Decision (EU) 2016/2295 of 16th December 2016 amending Decisions 2000/518/EC, 2002/2/EC, 2003/490/EC, 2003/821/EC, 2004/411/EC, 2008/393/EC, 2010/146/EU, 2010/625/EU, 2011/61/EU and Implementing Decisions 2012/484/EU, 2013/65/EU on the adequate protection of personal data by certain countries, pursuant to Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council;qCommission Implementing Decision (EU) 2016/2297 of 16th December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfer of personal data to third countries and to processors established in such countries, under Directive 95/46/EC of the European Parliament and of the Council;rRegulation (EU) 2018/1725 of the European Parliament and of the Council of 23rd October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.sCommission Decision (EU) 2019/165 of 1st February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings;tCommission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information;uRegulation (EU, Euratom) 2019/493 of the European Parliament and of the Council of 25th March 2019 amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament.Revocation of provisions of EEA agreement2Paragraphs 5e, 5ea, 5ed, 5ee, 5ef, 5eg, 5eh, 5ei, 5ek, 5el, 5em, 5en, 5eo, 5ep , 5eq, 5er and 5es of Annex 11 to the EEA agreement, as it forms part of the law of England and Wales, Scotland or Northern Ireland on and after IP completion day by virtue of section 3(1) of the European Union (Withdrawal) Act 2018, are revoked in so far as they are retained EU law.PART 2Amendments of primary legislationConsumer Credit Act 19743The Consumer Credit Act 1974 is amended as follows.4In section 157(2A)(a) (duty to disclose name etc of agency), for “GDPR” substitute “ UK GDPR ”.5In section 159(1)(a) (correction of wrong information), for “GDPR” substitute “ UK GDPR ”.6In section 189(1) (definitions)—aomit the definition of “the GDPR”;bat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.Pharmacy (Northern Ireland) Order 19767In paragraph 2 of Schedule 3 to the Pharmacy (Northern Ireland) Order 1976 (fitness to practice: disclosure of information)—ain sub-paragraph (2)(a), for “GDPR” substitute “ UK GDPR ”;bfor sub-paragraph (5) substitute—5In this paragraph, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Medical Act 19838The Medical Act 1983 is amended as follows.91Section 29E (evidence) is amended as follows.2In subsection (5), for “GDPR” substitute “ UK GDPR ”.3In subsection (9), omit the definition of “the GDPR”.101Section 35A (General Medical Council's power to require disclosure of information) is amended as follows.2In subsection (4), for “GDPR” substitute “ UK GDPR ”.3In subsection (7), omit the definition of “the GDPR”.11In section 55(1) (interpretation), at the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.12In paragraph 9B of Schedule 1 (incidental powers of the General Medical Council)—ain sub-paragraph (2)(a), for “GDPR” substitute “ UK GDPR ”;bomit sub-paragraph (4).13In paragraph 5A of Schedule 4 (professional performance assessments and health assessments)—ain sub-paragraph (8), for “GDPR” substitute “ UK GDPR ”;bomit sub-paragraph (14).Dentists Act 198414The Dentists Act 1984 is amended as follows.151Section 33B (the General Dental Council's power to require disclosure of information: the dental profession) is amended as follows.2In subsection (3), for “GDPR” substitute “ UK GDPR ”.3In subsection (4), in the definition of “relevant provision of the GDPR”—afor “the GDPR” (in both places) substitute “ the UK GDPR ”;bfor “GDPR provisions” substitute “ UK GDPR provisions ”.4Omit subsection (11).161Section 36Y (the General Dental Council's power to require disclosure of information: professions complementary to dentistry) is amended as follows.2In subsection (3), for “GDPR” substitute “ UK GDPR ”.3In subsection (4), in the definition of “relevant provision of the GDPR”—afor “the GDPR” (in both places) substitute “ the UK GDPR ”;bfor “GDPR provisions” (in the second place) substitute “ UK GDPR provisions ”.4Omit subsection (11).17In section 53(1) (interpretation), at the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.Opticians Act 1989181Section 13B of the Opticians Act 1989 (the Council's power to require disclosure of information) is amended as follows.2In subsection (3), for “GDPR” substitute “ UK GDPR ”.3For subsection (10) substitute—10In this section, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Immigration and Asylum Act 1999191Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows.2In subsection (4), for “GDPR” substitute “ UK GDPR ”.3For subsection (4A) substitute—4A“The UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Freedom of Information Act 2000201Section 40 of the Freedom of Information Act 2000 (personal information) is amended as follows.2In subsections (3B), (4A)(a) and (5B)(b) and (c), for “GDPR” substitute “ UK GDPR ”.3In subsection (7)—ain the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the words from “ “the GDPR”, “personal data”, “processing”” to the “(14) of that Act);”;cat the appropriate places insert—“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);;“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..4In subsection (8), for “GDPR” (in both places) substitute “ UK GDPR ”.Health and Personal Social Services Act (Northern Ireland) 2001211Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows.2In subsection (3), for “GDPR” substitute “ UK GDPR ”.3For subsection (8) substitute—8In this section, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Freedom of Information (Scotland) Act 2002221Section 38 of the Freedom of Information (Scotland) Act 2002 (personal information) is amended as follows.2In subsections (2B) and (3A)(a), for “GDPR” substitute “ UK GDPR ”.3In subsection (5)—ain the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the words from “ “the GDPR”, “personal data”, “processing”” to “(14) of that Act);”;cat the appropriate places insert—“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);;“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..4In subsection (5A), for “GDPR” (in both places) substitute “ UK GDPR ”.Mental Health (Care and Treatment) (Scotland) Act 2003231Section 279 of the Mental Health (Care and Treatment) (Scotland) Act 2003 (information for research) is amended as follows.2In subsection (2), for “GDPR” substitute “ UK GDPR ”.3For subsection (10) substitute—10In this section, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Crime and Courts Act 2013241Section 42 of the Crime and Courts Act 2013 (other interpretive provisions) is amended as follows.2In subsection (5)(a), for “GDPR” substitute “ UK GDPR ”.3For subsection (5A) substitute—5AIn subsection (5)(a), “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Small Business, Enterprise and Employment Act 2015251Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended as follows.2In subsection (7)(b), for “GDPR” substitute “ UK GDPR ”.3For subsection (7A) substitute—7AIn subsection (7), “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Social Security (Scotland) Act 2018261Section 60 of the Social Security (Scotland) Act 2018 (right to reports used in determining entitlement) is amended as follows.2In subsection (2), for “GDPR” substitute “ UK GDPR ”.3For subsection (3) substitute—3In subsection (2), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..PART 3Amendments of other legislationChannel Tunnel (International Arrangements) Order 1993271Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows.2In paragraph (2)—aafter “For the purposes of” insert “ Article 3 of the UK GDPR and ”;bin the words following paragraph (c), after “establishment (and” insert “ the UK GDPR and ”.3In paragraph (3)—aafter “For the purposes of” insert “ Article 3 of the UK GDPR and ”;bin the words following paragraph (b), after “establishment (and” insert “ the UK GDPR and ”.4After paragraph (3) insert—4In this article, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Channel Tunnel (Miscellaneous Provisions) Order 1994281Article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments) is amended as follows.2In paragraph (2)—aafter “For the purposes of” insert “ Article 3 of the UK GDPR and ”;bfor “the 2018 Act applies” substitute “ the UK GDPR and the 2018 Act apply ”.3In paragraph (3)—aafter “For the purposes of” insert “ Article 3 of the UK GDPR and ”;bfor “the 2018 Act does” substitute “ the UK GDPR and the 2018 Act do ”.4After paragraph (3) insert—4In this article, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Scottish Parliamentary Corporate Body (Crown Status) Order 199929In article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (Data Protection Act 2018) —ain paragraph (2)(a), (d) and (e), for “GDPR” substitute “ UK GDPR ”;bomit paragraph (5).Northern Ireland Assembly Commission (Crown Status) Order 199930In article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 (Data Protection Act 2018) —ain paragraph (2)(a), (d) and (e), for “GDPR” substitute “ UK GDPR ”;bomit paragraph (5).Representation of the People (England and Wales) Regulations 200131The Representation of the People (England and Wales) Regulations 2001 are amended as follows.321Regulation 3(1) (interpretation) is amended as follows.2In the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”.3Omit the definition of “the GDPR”.4At the appropriate place insert—“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;.33In regulation 92(2)(ba) (interpretation and application of Part VI etc), for “the GDPR” substitute “ the UK GDPR ”.Representation of the People (Scotland) Regulations 200134The Representation of the People (Scotland) Regulations 2001 are amended as follows.351Regulation 3(1) (interpretation) is amended as follows.2In the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”.3Omit the definition of “the GDPR”.4At the appropriate place insert—“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;.36In regulation 92(2)(ba) (interpretation of Part VI etc), for “the GDPR” substitute “ the UK GDPR ”.Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001371Regulation 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator workers to certain other persons) is amended as follows.2In paragraph (2B)(a), for “GDPR” substitute “ UK GDPR ”.3For paragraph (6) substitute—6In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Nursing and Midwifery Order 200138The Nursing and Midwifery Order 2001 is amended as follows.391Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows.2In paragraph (18), for “GDPR” substitute “ UK GDPR ”.3Omit paragraph (19).401Article 25 (the Council's power to require disclosure of information) is amended as follows.2In paragraph (3), for “GDPR” substitute “ UK GDPR ”.3In paragraph (6), omit the definition of “the GDPR”.41In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), omit the definition of “the GDPR”.42In Schedule 4 (interpretation), at the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.Electronic Commerce (EC Directive) Regulations 2002431Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.2In paragraph (1)(b), for “GDPR” substitute “ UK GDPR ”.3In paragraph (3)—aomit the definition of “the GDPR”;bat the appropriate place insert—“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;.Privacy and Electronic Communications (EC Directive) Regulations 200344In regulation 2(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 , for “GDPR” substitute “ UK GDPR ”.Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 200345The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.461Article 8 (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales) is amended as follows.2In paragraph (2), for “The Data Protection Act 2018” substitute “The UK GDPR and the Data Protection Act 2018.3After paragraph (2) insert—2AIn paragraph (2), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..471Article 11 (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect) is amended as follows.2In paragraph (4)—afor “The Data Protection Act 2018” substitute “ The UK GDPR and the Data Protection Act 2018 (“the 2018 Act”) ”;bfor “section 207 of that Act” substitute “ Article 3 of the UK GDPR and section 207 of the 2018 Act ”.3After paragraph (4) insert—4AIn paragraph (4), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Pupils' Educational Records (Scotland) Regulations 200348The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.49In regulation 2 (interpretation)—aomit the definition of “the GDPR”;bat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.50In regulation 6(aa) and (ab) (circumstances where information should not be disclosed), for “GDPR” substitute “ UK GDPR ”.51In regulation 9(1A) (in both places) and (1B), for “GDPR” substitute “ UK GDPR ”.Environmental Information Regulations 200452The Environmental Information Regulations 2004 are amended as follows.531Regulation 2 (interpretation) is amended as follows.2In paragraph (1)—ain the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the words from “ “the GDPR”” to “(14) of that Act);”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.3In paragraph (4A)—aafter “references to” insert “ the UK GDPR and ”;bafter “as if in” insert “ Article 2 of the UK GDPR and ”;cfor “(other general processing)” substitute “ (exemptions for manual unstructured processing and for national security and defence purposes) ”.54In regulation 13 (personal data), in paragraphs (2B)(a), (3A)(a), (5B)(b) and (c) and (6) (in both places), for “GDPR” substitute “ UK GDPR ”.Environmental Information (Scotland) Regulations 200455The Environmental Information (Scotland) Regulations 2004 are amended as follows.561Regulation 2 (interpretation) is amended as follows.2In paragraph (1)—ain the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the words from “ “the GDPR”” to “(14) of that Act);”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.3In paragraph (3A)—aafter “references to” insert “ the UK GDPR and ”;bafter “as if in” insert “ Article 2 of the UK GDPR and ”;cfor “(other general processing)” substitute “ (exemptions for manual unstructured processing and for national security and defence purposes) ”.57In regulation 11 (personal data), in paragraphs (3B), (4A)(a) and (7) (in both places), for “GDPR” substitute “ UK GDPR ”.Licensing Act 2003 (Personal Licences) Regulations 2005581Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence) is amended as follows.2In paragraph (1)(b)(iii), for “GDPR” substitute “ UK GDPR ”.3For paragraph (3) substitute—3In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Education (Pupil Information) (England) Regulations 2005591Regulation 5 of the Education (Pupil Information) (England) Regulations 2005 (disclosure of curricular and educational records) is amended as follows.2In paragraph (4), for “GDPR” (in both places) substitute “ UK GDPR ”.3For paragraph (7) substitute—7In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act)..Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005601Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information) is amended as follows.2In paragraphs (1B)(a) and (1C)(a), for “GDPR” substitute “ UK GDPR ”.3In paragraph (1D)—ain the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the words from “ “the GDPR”” to “(14) of that Act);”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.4In paragraph (1E), for “GDPR” (in both places) substitute “ UK GDPR ”.Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005611Regulation 39 of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (sensitive information) is amended as follows.2In paragraphs (1B)(a) and (1C)(a), for “GDPR” substitute “ UK GDPR ”.3In paragraph (1D)—ain the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the words from “ “the GDPR”” to “(14) of that Act);”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.4In paragraph (1E), for “GDPR” (in both places) substitute “ UK GDPR ”.Register of Judgments, Orders and Fines Regulations 200562In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation) —ain the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the definition of “the GDPR”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.National Assembly for Wales (Representation of the People) Order 2007631Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on the use, supply and inspection of absent vote records or lists) is amended as follows.2In sub-paragraph (1)(a), for “GDPR” substitute “ UK GDPR ”.3For sub-paragraph (2) substitute—2In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..National Assembly for Wales Commission (Crown Status) Order 200764In article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 (Data Protection Act 2018) —ain paragraph (2)(a), (d) and (e), for “GDPR” substitute “ UK GDPR ”;bomit paragraph (5).Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007651Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection of absent voter records or lists) is amended as follows.2In paragraph (1)(a), for “GDPR” substitute “ UK GDPR ”.3For paragraph (2) substitute—2In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007661Regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection) is amended as follows.2In paragraph (2)(i), for “GDPR” substitute “ UK GDPR ”.3For paragraph (4) substitute—4In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 200767The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 are amended as follows.68In regulation 2 (interpretation)—aomit the definition of “the GDPR”;bat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.69In regulation 10(2) (duties of Boards of Governors), for “GDPR” substitute “ UK GDPR ”.Representation of the People (Northern Ireland) Regulations 2008701Regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to public inspection) is amended as follows.2In paragraph (2), for “GDPR” substitute “ UK GDPR ”.3For paragraph (4) substitute—4In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 200871. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008761Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation) is amended as follows.2In paragraph (3B)(a), for “GDPR” substitute “ UK GDPR ”.3In paragraph (5)—ain the definition of “data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the definition of “the GDPR”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.INSPIRE Regulations 2009771Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.2In paragraph (2)(b), for “GDPR” substitute “ UK GDPR ”.3In paragraph (8)—ain the definition of “data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the definition of “the GDPR”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.4In paragraph (9), for “GDPR” (in both places) substitute “ UK GDPR ”.INSPIRE (Scotland) Regulations 2009781Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.2In paragraph (2)(b), for “GDPR” substitute “ UK GDPR ”.3In paragraph (7)—ain the definition of “data protection principles”, for “GDPR” substitute “ UK GDPR ”;bomit the definition of “the GDPR”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.4In paragraph (8), for “GDPR” (in both places) substitute “ UK GDPR ”.Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 200979The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.80In regulation 2(2) (interpretation)—aomit the words from “ “the GDPR”” to “(14) of that Act);”;bat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.81In regulation 25(7) (duty to co-operate by disclosing information as regards relevant persons), for “GDPR” substitute “ UK GDPR ”.82In regulation 26(6) (responsible bodies requesting additional information be disclosed about relevant persons), for “GDPR” substitute “ UK GDPR ”.83In regulation 29(3) (occurrence reports), for “GDPR” substitute “ UK GDPR ”.Pharmacy Order 201084The Pharmacy Order 2010 is amended as follows.85In article 3(1) (interpretation), at the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.86In article 9(5) (inspection and enforcement), for “and references to Schedule 2 to the Data Protection Act 2018 have” substitute “ has ”.871Article 49 (disclosure of information: general) is amended as follows.2In paragraph (2)(a), for “GDPR” substitute “ UK GDPR ”.3Omit paragraph (6).881Article 55 (professional performance assessments) is amended as follows.2In paragraph (5)(a), for “GDPR” substitute “ UK GDPR ”.3Omit paragraph (9).Local Elections (Northern Ireland) Order 201089In paragraph 1(1) of Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election) —ain the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”;bomit the definition of “the GDPR”;cat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.Pupil Information (Wales) Regulations 201190. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Police and Crime Commissioner Elections Order 201292The Police and Crime Commissioner Elections Order 2012 is amended as follows.931Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows.2In paragraph 20 (absent voter lists: supply of copies etc)—ain sub-paragraph (8)(a), for “GDPR” substitute “ UK GDPR ”;bfor sub-paragraph (11) substitute—11In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..3In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—ain sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;bfor sub-paragraph (4) substitute—4In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..941Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows.2In paragraph 5 (restriction on use of absent voter records or lists or the information contained in them)—ain sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;bfor sub-paragraph (5) substitute—5In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018..Neighbourhood Planning (Referendums) Regulations 201295In paragraph 29(1) of Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (interpretation of Part 8) —ain the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”;bomit the definition of “the GDPR”;cin the definition of “relevant requirement”, for “the GDPR” substitute “ the UK GDPR ”;dat the appropriate place insert—“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;.Controlled Drugs (Supervision of Management and Use) Regulations 2013961Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows.2In paragraph (5), for “GDPR” (in both places) substitute “ UK GDPR ”.3For paragraph (7) substitute—7In this regulation, “personal data” and “the UK GDPR” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (10) and (14) of that Act)..Small and Medium Sized Business (Credit Information) Regulations 2015971Regulation 15 of the Small and Medium Sized Business (Credit Information) Regulations 2015 (access to and correction of information for individuals and small firms) is amended as follows.2In paragraph (1), for “GDPR” substitute “ UK GDPR ”.3Omit paragraph (4).Scottish Parliament (Elections etc) Order 201598The Scottish Parliament (Elections etc) Order 2015 is amended as follows.991Schedule 3 (absent voting) is amended as follows.2In paragraph 16 (absent voting lists: supply of copies etc)—ain sub-paragraph (4)(a), for “GDPR” substitute “ UK GDPR ”;bfor sub-paragraph (11) substitute—11In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.3In paragraph 20 (restriction on use of absent voting lists)—ain sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;bfor sub-paragraph (4) substitute—4In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.100In Schedule 8 (access to marked registers and other documents open to public inspection after an election), in paragraph 5 (restriction on use of documents)—ain sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;bfor sub-paragraph (5) substitute—5In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.Electronic Identification and Trust Services for Electronic Transactions Regulations 2016101In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (Information Commissioner's enforcement powers) , in paragraph 16(a) and (b) (modification of section 159 of the Data Protection Act 2018), for “GDPR” substitute “ UK GDPR ”.Court Files Privileged Access Rules (Northern Ireland) 2016102The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.103In rule 2 (interpretation), at the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.104In rule 5(a) (information that may be released), for “GDPR” substitute “ UK GDPR ”.105In rule 7(2)(a) (provision of information), for “GDPR” substitute “ UK GDPR ”.Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017106The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended as follows.107In regulation 3(1) (interpretation)—aomit the words from “ “the GDPR” to “(14) of that Act);”;bat the appropriate place insert—“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);.108In regulation 16(8)(b) (risk assessment by the Treasury and Home Office), for “GDPR” substitute “ UK GDPR ”.109In regulation 17(9)(b) (risk assessment by supervisory authorities), for “GDPR” substitute “ UK GDPR ”.110In regulation 41 (data protection), in paragraphs (3)(a), (6), (7), (8) and (9), for “GDPR” substitute “ UK GDPR ”.PART 4ModificationReferences to the GDPR1111Legislation described in sub-paragraph (2) has effect on and after IP completion day as if it were modified in accordance with sub-paragraphs (3) and (4) (but see sub-paragraph (5)).2That legislation is—asubordinate legislation made on or before IP completion day;bprimary legislation passed or made on or before IP completion day”.3The following have effect as references to the UK GDPR—areferences to the GDPR as defined in section 3(10) of the 2018 Act or as defined for the purposes of Parts 5 to 7 of the 2018 Act;bother references to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).4References described in sub-paragraph (3) which are references to the GDPR or the Regulation read with Chapter 2 of Part 2 of the 2018 Act have effect as references to the UK GDPR read with Part 2 of that Act.5Sub-paragraphs (1) to (4) have effect unless the context otherwise requires and, in particular, do not affect references to the Regulation mentioned in sub-paragraph (3)(b) as it has effect in EU law.6Paragraph 2 of Schedule 21 to the 2018 Act (inserted by these Regulations) has effect in relation to references to the UK GDPR arising as a result of this paragraph as it has effect in relation of other references to the UK GDPR.7In this paragraph—“primary legislation” has the meaning given in section 211 of the 2018 Act;“references” includes any references, however expressed;“subordinate legislation” has the meaning given in the Interpretation Act 1978.PART 5SupplementaryInterpretation of references to enactments112Nothing in Parts 2 to 4 of this Schedule is to be read as implying anything about whether references to an enactment or statutory provision (whether in Acts or instruments amended by those Parts of this Schedule or elsewhere) include the UK GDPR or other assimilated direct legislation.SCHEDULE 4Amendments consequential on provisions of the 2018 Act Regulation 7Anti-terrorism, Crime and Security Act 200111Part 1 of Schedule 4 to the Anti-terrorism, Crime and Security Act 2001 (extension of existing disclosure powers) is amended as follows.2Omit paragraph 42.3After paragraph 53F insert—53GSection 132(1) of the Data Protection Act 2018.Investigatory Powers Act 20162In section 202(4) of the Investigatory Powers Act 2016 (restriction on use of class BDP warrants) , in the definition of “sensitive personal data”, for “section 2(a) to (f) of the Data Protection Act 1998” substitute “ section 86(7)(a) to (e) of the Data Protection Act 2018 ”.Data Protection Act 20183In Schedule 19 to the Data Protection Act 2018 (minor and consequential amendments) , omit paragraphs 76 and 201.

(This note is not part of the Regulations)

These Regulations make amendments to legislation in relation to the regulation of the processing of personal data.

These Regulations are made in exercise of the powers in sections 8(1) and 23(1) of, and paragraphs 21 of Schedule 7 and 1(1) of Schedule 4 to, the European Union (Withdrawal) Act 2018 (c.16) (“the EUWA 2018”), in order to address failures of retained EU law to operate effectively and other deficiencies (in particular under section 8(2)(a), (b), (d) and (g)) arising from the withdrawal of the United Kingdom (“UK”) from the European Union (“EU”).

These Regulations also exercise powers in section 211(2) of the Data Protection Act 2018 (“the DPA 2018”) to make provision consequential to that Act, and in section 2(2) of the European Communities Act 1972 (c.68) for the purpose of implementing an EU obligation of the UK.

Regulations 1 and 2 cover citation, commencement, extent and interpretation.

Regulation 3 introduces Schedule 1, which amends Regulation (EU) 2016/679 of the European Parliament and of the Council (“the GDPR”) as it forms part of domestic law by virtue of section 3 of the EUWA 2018.

Regulation 4 introduces Schedule 2, which amends the DPA 2018.

Among other things, changes made by Schedules 1 and 2 have the effect of merging two pre-existing regimes for the regulation of the processing of personal data – namely that established by the GDPR as supplemented by Chapter 2 of Part 2 of the DPA 2018 as originally enacted, and that established in Chapter 3 of Part 2 of the DPA 2018 as originally enacted (“the applied GDPR”). The applied GDPR extended GDPR standards to certain processing out of scope of EU law and the GDPR.

Regulation 5 makes provision concerning interpretation in relation to processing that prior to exit day was subject to the applied GDPR.

Regulation 6 introduces Schedule 3, which makes amendments to other legislation. Part 1 of Schedule 3 revokes certain EU data protection law that forms part of domestic law by virtue of section 3 of the EUWA 2018. Parts 2 and 3 of Schedule 3 make amendments to other legislation consequential to the amendments made in Schedules 1 and 2. Part 4 of Schedule 3 makes general provision for references to the GDPR (that are not otherwise amended by Parts 2 or 3) to have effect as references to the UK GDPR on and after exit day. Part 5 of Schedule 3 makes supplementary provision in respect of Parts 2, 3 and 4.

Regulation 7 introduces Schedule 4 which makes amendments consequential to the DPA 2018 to the Anti-terrorism, Crime and Security Act 2001 (c.24) and to the Investigatory Powers Act 2016 (c.25). Related amendments appear in paragraphs 76 and 201 (respectively) of schedule 19 to the DPA but have not been commenced. Regulation 7 repeals those provisions.

Regulation 8 makes amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2002/2013) in light of provision made by the GDPR relating to the meaning of “consent”.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.

2018 c. 16.2018 c. 12.1972. c. 68. Section 2 was amended by section 27(1)(a) of the Legislative and Regulatory Reform Act 2006 (c.51) and Part 1 of the Schedule to the European Union (Amendment) Act 2008 (c. 7).S.I. 2003/2426.These regulations make a further amendment to this provision (see Sch. 3, para. 3).OJ L 281, 23.11.1995, p31-50.OJ L 178, 17/07/2000, p1-16.S.I. 2002/2013.Section 17A is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 23).OJ L 201, 31.7.2002, p37-47.Such domestic legislation includes the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) (“PECR”) and the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (S.I. 2000/2699) (as amended by PECR).Section 17B is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 23).Section 17C is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 23).Section 119A is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 51).The definition of the EU GDPR is inserted into section 3 of the 2018 Act by these Regulations (see Sch. 2, para. 4(5)).Section 205(4) is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 85(7)).OJ L 215, 25.8.2000, p. 1-3.OJ L 2, 4.1.2002, p. 13-16.OJ L 168, 05.07.2003, p. 19-22.OJ L 308, 25.11.2003 p. 27-28.OJ L 151, 30.4.2004. , p. 48-51.OJ L 138, 28.5.2008, p. 21-23.OJ L 58, 9.3.2010, p. 17-19.OJ L 277, 21.10.2010, p. 27-29.OJ L 27, 1.2.2011, p. 39-42OJ L 227, 23.8.2012, p. 11-14.OJ L 28, 30.1.2013, p. 12-14.OJ L 181, 4.7.2001, p. 19-31.OJ L 385, 29.12.2004, p. 74-84.OJ L 39, 12.2.2010, p. 5-18.OJ L 344, 17.12.2016, p. 83-91.OJ L 344, 17.12.2016, p. 100-101.1974 c. 39.S.I. 1976/1213 (N.I. 22)1983 c. 54.1984 c. 24.1989 c. 44.1999 c. 33.2000 c. 36.2001 c.3 (N.I.).2002 asp 13.2003 asp 13.2013 c. 22.2015 c. 26.2018 asp 9.S.I. 1993/1813.S.I. 1994/1405.S.I. 1999/677.S.I. 1999/3145.S.I. 2001/341.S.I. 2001/497.S.I. 2001/2188.S.I. 2002/253.S.I. 2002/2013.S.I. 2003/2426.S.I. 2003/2818.S.S.I. 2003/581.S.I. 2004/3391.S.S.I. 2004/520.S.I. 2005/41.S.I. 2005/1437.S.I. 2005/2042.S.S.I. 2005/494.S.I. 2005/3595.S.I. 2007/236.S.I. 2007/1118.S.S.I. 2007/170.S.S.I. 2007/264.S.R. (N.I.) 2007 No. 43.S.I. 2008/1741.S.R. (N.I.) 2008 No. 3.S.I. 2009/3157.S.S.I. 2009/440.S.R. (N.I.) 2009 No. 225.S.I. 2010/231.S.I. 2010/2977.S.I. 2012/1917.S.I. 2012/2031.S.I. 2013/373.S.I. 2015/1945.S.S.I. 2015/425.S.I. 2016/696.S.R. (N.I.) 2016 No. 123.S.I. 2017/692.2001 c. 24.2016 c. 25.2018 c.12.Sch. 2 para. 59 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 68 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 71 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 3 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 13 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 51 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 78 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 11 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 1 para. 80 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 4(6)Sch. 1 para. 5 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 50 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 12 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in reg. 5(2) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(3)Reg. 8 in force at 29.3.2019, see reg. 1(3)Sch. 2 para. 61 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 1 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 37 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 63 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 40 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 101 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 88 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 90 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 19 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in reg. 5(4) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(5)Sch. 1 para. 46 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 35 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 71 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 44 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 85 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(2)Words in Sch. 1 para. 6(13) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 4(3)(b)Sch. 1 para. 6 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 25 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 48 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 95 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 109 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 73 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 1 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 18 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 70 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 69 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 24 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(k)(ii)Sch. 3 para. 101 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 26 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 58 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(g)(iv)Sch. 3 para. 57 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 99 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(a)Sch. 2 para. 65 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 84 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 58 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 11 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 4 para. 2 in force at 29.3.2019, see reg. 1(3)Sch. 2 para. 66 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(e)(ii)(bb)Sch. 1 para. 74 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 1(aa) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(a)Sch. 3 para. 39 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 73 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 22 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 53 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 107 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(i)(ii)Sch. 2 para. 89 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 45 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 35 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 100 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(o)Sch. 3 para. 1(s)-(u) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(d)Sch. 2 para. 53 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 81 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Reg. 7 in force at 29.3.2019, see reg. 1(3)Words in reg. 5(3) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(4)Sch. 1 para. 18 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 49 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 4 para. 3 in force at 29.3.2019, see reg. 1(3)Sch. 3 para. 14 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 4 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 43 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 25 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 79 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 49 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 45 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 43 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 1 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 28 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 74 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 47 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 67 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 98 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 17 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 41 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 3 para. 2 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(3)(a)Sch. 3 para. 105 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 50 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(c)Sch. 3 para. 83 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 98 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 3 para. 111(1) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(4)(a)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(l)(ii)Sch. 3 para. 56 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 89 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 110 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 12 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(n)Sch. 2 para. 30 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 85 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 15 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 10 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(g)(i)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(k)(i)Sch. 3 para. 19 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in reg. 5(1) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(2)Sch. 2 para. 60 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 83 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 75 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 3 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 8 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 72 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 97 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 34 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 15 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 65 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 53 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 28 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 77 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 63 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 72 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(e)(iii)Sch. 3 para. 47 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 42 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Reg. 1 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 1 para. 4(2) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 4(2)Sch. 3 para. 5 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 19 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 91 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 111 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(g)(iii)Sch. 1 para. 44 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(f)(ii)Sch. 3 para. 108 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 13 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 31 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 66 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 35 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 37 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 21 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 63 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 20 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 1(fa) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(b)Sch. 4 para. 1 in force at 29.3.2019, see reg. 1(3)Sch. 2 para. 68 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 8 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 42 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 1 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 76 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 112 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 96 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 93 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 12 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 3 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 57 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 55 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 102 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 75 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 40 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(j)Sch. 3 para. 61 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 64 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 82 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 24 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 102 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Reg. 5 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 48 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 64 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 31 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 7 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 23 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 32 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 62 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 51 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 30 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(b)(i)Sch. 3 para. 27 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 21 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 68 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 9 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 27 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 46 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 46 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 38 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 69 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 96 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 23 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 4 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 48 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 6 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 33 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 80 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Reg. 4 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 38 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 omitted (31.12.2020 immediately before IP completion day) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(e)(ii)(aa)Sch. 2 para. 41 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 70 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 11 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 62 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 40 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 77 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 22 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 33 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 39 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 78 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(f)(iii)Sch. 1 para. 29 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 52 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 8 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 17 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 36 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 1 para. 74(3) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 4(5)Sch. 2 para. 32 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 16 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 15 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(l)(i)Sch. 2 para. 26 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 27 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 76 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 59 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 17 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 56 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 97 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 16 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 2 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 44 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 7 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 18 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 85 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 36 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 86 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 51 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 34 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 94 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 84 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(b)(ii)Sch. 2 para. 45 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 99 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 88 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 52 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 54 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 29 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 1 para. 6(12) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 4(3)(a)Sch. 3 para. 29 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 7 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 42 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 14 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 28 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 92 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 33 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 57 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 76 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 60 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 16 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 90 omitted (31.12.2020 immediately before IP completion day) by virtue of The Retained EU Law (Miscellaneous Amendments) (Wales) (EU Exit) Regulations 2019 (S.I. 2019/1281), regs. 1(3), 9; 2020 c. 1, Sch. 5 para. 1(1)Sch. 1 para. 37 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(f)(i)Sch. 2 para. 24 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 59 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 1(ha) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(c)Sch. 1 para. 9 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 39 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 101(4)(b) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(3)Sch. 3 para. 106 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 43 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 77 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 78 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 20 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 3 para. 111(2) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(4)(b)Sch. 2 para. 93 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 30 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(e)(i)Sch. 2 para. 86 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 79 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 20 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 67 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 79 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 62 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 52 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 54 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 22 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 6 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 paras. 71-75 omitted (31.12.2020 immediately before IP completion day) by virtue of The Retained EU Law (Miscellaneous Amendments) (Wales) (EU Exit) Regulations 2019 (S.I. 2019/1281), regs. 1(3), 9; 2020 c. 1, Sch. 5 para. 1(1)Sch. 3 para. 87 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 2 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 67 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 103 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 14 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Reg. 3 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(g)(ii)Sch. 2 para. 64 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 23 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 36 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Reg. 6 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 65 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 69 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 61 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 100 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 1 para. 17(b) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 4(4)Sch. 3 para. 81 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(h)Sch. 1 para. 58 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 92 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 56 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 66 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 49 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 82 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 31 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 10 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 50 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 55 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Reg. 2 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(m)Sch. 3 para. 91 omitted (31.12.2020 immediately before IP completion day) by virtue of The Retained EU Law (Miscellaneous Amendments) (Wales) (EU Exit) Regulations 2019 (S.I. 2019/1281), regs. 1(3), 9; 2020 c. 1, Sch. 5 para. 1(1)Sch. 3 para. 38 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 26 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 94 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 54 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 5 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 21 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 47 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 87 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 13 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(i)(i)Words in Sch. 3 para. 2 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(3)(b)Sch. 3 para. 60 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in Sch. 2 para. 102 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 5(4)(d)Sch. 1 para. 25 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 55 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 70 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 4 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 2 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 80 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 80 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 9 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 41 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 1 para. 34 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 2 para. 95 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 32 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Sch. 3 para. 104 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)Words in reg. 5(2) substituted (27.2.2025) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(a)(i)(aa)Word in reg. 5(2) substituted (27.2.2025) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(a)(i)(bb)Words in reg. 5(3) substituted (27.2.2025) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(a)(ii)(aa)Words in reg. 5(3) substituted (27.2.2025) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(a)(ii)(bb)Words in reg. 5(4) omitted (27.2.2025) by virtue of The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(a)(iii)(aa)Words in reg. 5(4) inserted (27.2.2025) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(a)(iii)(bb)Reg. 5(4): full stop substituted for semicolon (27.2.2025) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(a)(iii)(cc)Words in Sch. 3 para. 112 substituted (27.2.2025) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendments) Regulations 2025 (S.I. 2025/82), reg. 1(2), Sch. 7 para. 2(b)