The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026

41.—(1) The UK GDPR(1) is amended as follows.

(2) In Article 4—

(a) after paragraph (A2) insert—

“(A2A) ‘the Commission’ means the Information Commission (see section 114A of the 2018 Act);”;

(b) omit paragraph (A3).

(3) In each of the provisions listed in sub-paragraph (4)—

(a) for “Commissioner”, in each place it occurs, substitute “Commission”;

(b) for “Commissioner’s”, in each place it occurs, substitute “Commission’s”.

(4) The provisions are—

(a) Article 12(4), (6A) and (6B);

(b) Article 13(2)(d);

(c) Article 14(2)(e);

(d) Article 15(1)(f);

(e) Article 27(4);

(f) Article 28(8);

(g) Article 30(4);

(h) Article 31 (including the heading);

(i) in Article 33—

(i) the heading;

(ii) paragraphs (1) and (5);

(j) Article 34(4);

(k) Article 35(4) and (5);

(l) Article 36(1), (2), (3) and (4);

(m) Article 37(7);

(n) Article 39(1)(d) and (e);

(o) Article 40(1), (2)(i), (4), (5) and (6);

(p) Article 41(1), (2)(a) and (d), (4), (4A) and (5);

(q) Article 42(1), (4), (5), (6), (7) and (8);

(r) Article 43(1), (2)(a), (b) and (e), (3), (5), (6) and (7);

(s) Article 46(2) and (3);

(t) Article 47(1) and (2)(e), (j), (k), (l) and (m);

(u) Article 47A(6)(b);

(v) Article 49(1);

(w) Article 50;

(x) the heading of Chapter VI;

(y) Article 51;

(z) Article 52(1), (2) and (3);

(z1) in Article 57—

(i) paragraphs (1), (3) and (4);

(ii) paragraph (2), subject to regulation 1(4);

(z2) Article 58(1), (2), (3) and (3A);

(z3) in Article 77—

(i) the heading;

(ii) paragraphs (1) and (2)

subject to regulation 1(4);

(z4) in Article 78—

(i) the heading;

(ii) paragraphs (1) and (2);

(z5) Article 79(1);

(z6) Article 80(2), subject to regulation 1(4);

(z7) Article 83(1), (2)(f) and (h), (5)(e), (6) and (10);

(z8) Article 85(2);

(z9) Article 91A(2)(a).

(5) In Article 40(5), for “who” substitute “which”.

(6) In Article 52(3), for the words beginning with “shall not” to the end, substitute “its members shall refrain from any action incompatible with the Commission’s duties.”.

(1)

In accordance with section 66 of the Data (Use and Access) Act 2025, “the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Relevant amendments to the UK GDPR have been made by the Data (Use and Access) Act 2025, S.I. 2019/419 and 2023/1417.