The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025

Transitional and saving provisions relating to the national security exemption

4.—(1) Section 88 of the 2025 Act does not affect the application of—

(a) Chapter 3 of Part 3 of the 2018 Act, in a case in which a controller received a request under a section of that Chapter before the relevant time;

(b) section 51 (exercise of rights through the Commissioner) of the 2018 Act, in a case in which the Commissioner received a request under that section before the relevant time;

(c) sections 67 and 68 (obligations relating to personal data breaches) of the 2018 Act, in a case in which a personal data breach (within the meaning given by section 33(2) of the 2018 Act) occurred before the relevant time(1);

(d) section 119 (inspection of personal data) of the 2018 Act, in a case in which a controller received written notice under that section before the relevant time;

(e) Schedule 13 (other general functions of the Commissioner) to the 2018 Act, in a case in which the Commissioner(2)—

(i) commenced enforcement action pursuant to paragraph 1(1)(a) of that Schedule, before the relevant time; or

(ii) received information under paragraph 1(1)(g) of that Schedule, before the relevant time;

(f) sections 142 to 154 (enforcement) of, and Schedule 15 (powers of entry and inspection) to, the 2018 Act, in relation to any of the following which is received by a controller before the relevant time(3)—

(i) an information notice;

(ii) an assessment notice;

(iii) an enforcement notice;

(g) section 173 (alteration of personal data to prevent disclosure) of the 2018 Act, in a case in which a controller received a request pursuant to that section before the relevant time(4);

(h) section 187 (representation of data subjects) of the 2018 Act, in a case in which, before the relevant time, a body or other organisation authorised to act on behalf of a data subject in accordance with that section(5)—

(i) made a complaint to the Commissioner under section 165 (complaints by data subjects)(6);

(ii) made an application to the Tribunal under section 166 (orders to progress complaints)(7);

(iii) made an application to the court under section 167 (compliance orders)(8); or

(iv) brought judicial review proceedings.

(2) Section 88 of the 2025 Act does not affect the application of section 79(2) to (13) of the 2018 Act to a certificate issued under section 79(1) before the relevant time.

(1)

Section 67 was amended by S.I. 2019/419.

(2)

Schedule 13 was amended by S.I. 2019/419.

(3)

Sections 142 and 143 were amended by the Data (Use and Access) Act 2025, section 97 and S.I. 2019/419. Sections 145 and 148 were amended by the Data (Use and Access) Act 2025, section 97.

(4)

Section 173 was amended by S.I. 2019/419.

(5)

Section 187 was amended by S.I. 2019/419.

(6)

Section 165 was amended by S.I. 2019/419.

(7)

Section 166 was amended by S.I. 2019/419.

(8)

Section 167 was amended by S.I. 2019/419.