- accreditation authority
means— (a) the Commission, or (b) the UK national accreditation body;
- act
includes a failure to act;
- added processing
means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
- adequacy decision
means a decision made on the basis of— (a) Article 45(3) of the EU GDPR, or (b) Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
- age-appropriate design
means the design of services so that they are appropriate for use by, and meet the development needs of, children;
- anti-fraud organisation
has the same meaning as in section 68 of the Serious Crime Act 2007.
- appropriate person
means a person who the Secretary of State considers has appropriate experience and skills to produce a report described in subsection (1);
- appropriate security
includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).
- assessment notice
has the meaning given in section 146;
- binding corporate rules
has the meaning given in Article “4(1)(20) of the UK GDPR.
- biometric data
means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data;
- carer
means an individual who provides or intends to provide care for another individual other than— (a) under or by virtue of a contract, or (b) as voluntary work;
- caution
means a caution given to a person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted;
- certification provider
has the meaning given in section 17;
- child abuse
includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, an individual aged under 18.
- competent authority
has the same meaning as in Part 3;
- controller
has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);
- Convention rights
has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);
- conviction
has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (S.I. 1978/1908 (N.I. 27));
- corporate finance service
means a service consisting in— (a) underwriting in respect of issues of, or the placing of issues of, any instrument, (b) services relating to such underwriting, or (c) advice to undertakings on capital structure, industrial strategy and related matters and advice and service relating to mergers and the purchase of undertakings;
- damage
includes financial loss and damage not involving financial loss, such as distress.
- data concerning health
means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;
- data controller
has the same meaning as in the 1998 Act (see section 1 of that Act);
- data protection functions
means functions relating to the protection of individuals with respect to the processing of personal data;
- data protection officer
means a person designated as a data protection officer under the data protection legislation;”
- data protection principle relating to accuracy
means the principle in—
- data subject
has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
- data subject access right
means a right under—
- Designation notice
has the meaning given in section 82A.
- direct marketing
means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;
- disability
has the same meaning as in the Equality Act 2010 (see section 6 of, and Schedule 1 to, that Act).
- domestic premises
means premises, or a part of premises, used as a dwelling;
- education data
has the meaning given by paragraph 17 of this Schedule;
- education-related worker
means a person referred to in paragraph 14(4)(a) or (b) or 16(4)(a), (b) or (c) of Schedule 3 (educational records);
- educational record
means a record to which paragraph 14, 15 or 16 applies.
- elected representative
has the same meaning as in paragraph 23.
- employment
means any employment, including— (a) work under a contract for services or as an office-holder, (b) work under an apprenticeship, (c) work experience as part of a training course or in the course of training for employment, and (d) voluntary work, and “employee” is to be interpreted accordingly;
- enactment
includes— (a) an enactment passed or made after this Act, (b) an enactment comprised in subordinate legislation, (c) an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales, (d) an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,...
- enforcement notice
has the meaning given in section 149;
- enforcement powers
means the powers under— (a) Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR, (b) sections 142 to 159 of this Act, (c) paragraph 2(a), (b) and (c) of Schedule 13 to this Act, and (d) Schedules 15 and 16 to this Act;
- exam
means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity.
- Filing system
means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis.
- Financial Ombudsman
means the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act);
- financial year
means—
- foreign designated authority
means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
- genetic data
means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;
- good practice in direct marketing
means such practice in direct marketing as appears to the Commission to be desirable having regard to the interests of data subjects and others, including compliance with the requirements mentioned in subsection (1)(a);
- good practice in the processing of personal data
means such practice in the processing of personal data as appears to the Commission to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- good practice in the sharing of personal data
means such practice in the sharing of personal data as appears to the Commission to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- government department
includes the following (except in the expression “United Kingdom government department”)— (a) a part of the Scottish Administration;
- Health and Social Care trust
means a Health and Social Care trust established under the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1));
- health or social care purposes
means the purposes of—
- health professional
has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).”
- health record
means a record which— (a) consists of data concerning health, and (b) has been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates;
- health service body
means any of the following—
- HMRC
means Her Majesty's Revenue and Customs. 125B 1 A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific). 2 A person who contravenes subsection (1) is guilty of an offence. 3 It is a defence for a person charged with an offence under this section to prove that the person reasonably believed— a that the disclosure was lawful, or b that the information had already lawfully been made available to the public. 4 Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they a
- Identifiable living individual
means a living individual who can be identified, directly or indirectly, in particular by reference to—
- independent school
has the meaning given by section 463 of the Education Act 1996;
- individual at economic risk
means an individual who is less able to protect his or her economic well-being by reason of physical or mental injury, illness or disability.
- information notice
has the meaning given in section 142;
- information relating to another individual
includes information identifying the other individual as the source of information;
- information society services
has the same meaning as in the UK GDPR, but does not include preventive or counselling services;
- instrument
means an instrument listed in section C of Annex 1 to Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, and references to an instrument include an instrument not yet in existence but which is to be or may be created;
- insurance contract
means a contract of general insurance or long-term insurance;
- insurance purpose
means— (a) advising on, arranging, underwriting or administering an insurance contract, (b) administering a claim under an insurance contract, or (c) exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.
- intelligence service
means—
- international obligation of the United Kingdom
includes— (a)................................
- international organisation
means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
- interview notice
has the meaning given in section 148A;
- investigator of complaints against the financial regulators
means the person appointed under section 84(1)(b) of the Financial Services Act 2012;
- key performance indicators
means factors by reference to which the Commission's performance can be measured most effectively.
- local authority
has the same meaning as in that Act (see sections 579(1) and 581 of that Act);
- media organisation
means a body or other organisation whose activities consist of or include journalism.
- medical purposes
includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.
- Minister of the Crown
has the same meaning as in the Ministers of the Crown Act 1975;
- non-maintained special school
has the meaning given by section 337A of that Act;
- non-material damage
includes distress.
- non-UK recipient
means— (a) a recipient in a third country, or (b) an international organisation.
- Northern Ireland Minister
includes the First Minister and deputy First Minister in Northern Ireland.
- occupational pension scheme
has the meaning given in section 1 of the Pension Schemes Act 1993;
- payment card
includes a credit card, a charge card and a debit card.
- penalty
means a penalty imposed by a penalty notice.
- penalty notice
has the meaning given in section 155;
- penalty variation notice
has the meaning given in Schedule 16;
- personal data
has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). 1E In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
- Personal data breach
means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
- pre-commencement enactment
means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
- premises
includes a vehicle, vessel or other means of transport, and
- price
includes value;
- primary legislation
means—
- Principal Reporter
means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;
- prison
includes a young offender institution, a remand centre, a secure training centre or a secure college;
- prisoner
means a person detained in a prison.
- privileged communications
means—
- processing
has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act).”
- processor
means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).
- Profiling
means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
- proprietor
has the meaning given by section 579(1) of that Act.
- protected condition in Schedule 10
means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).
- protected condition in Schedule 8
means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).
- protective function
means a function which is intended to protect members of the public against—
- public authority
has the same meaning as in the 2000 Act;
- public body
means a body or other person whose functions are, or include, functions of a public nature, and
- publish
means make available to the public or a section of the public (and related expressions are to be read accordingly);
- pupil
means— (a) in relation to a school in England and Wales, a registered pupil within the meaning of the Education Act 1996, (b) in relation to a school in Scotland, a pupil within the meaning of the Education (Scotland) Act 1980, and (c) in relation to a school in Northern Ireland, a registered pupil within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3));
- qualifying competent authority
means a competent authority specified or described in regulations made by the Secretary of State.
- references
includes any references, however expressed.
- registered medical practitioner
includes a person who is provisionally registered under section 15 or 21 of the Medical Act 1983 and is engaged in such employment as is mentioned in subsection (3) of that section.
- regulatory function
has the meaning given by section 111 of the Deregulation Act 2015.
- regulatory requirement
means— (a) a requirement imposed by legislation or by a person in exercise of a function conferred by legislation, or (b) a requirement forming part of generally accepted principles of good practice relating to a type of body or an activity.
- relevant alternative dispute resolution procedures
means alternative dispute resolution procedures provided by persons who produce or enforce codes of practice for relevant media organisations;
- relevant authority
has the same meaning as in section 5 of the Local Government and Housing Act 1989, and “monitoring officer”, in relation to such an authority, means a person designated as such under that section;
- relevant contravention
means contravention in a manner described in paragraph 8 of Part 2 of Schedule 1 to the 1998 Act (sixth data protection principle).
- relevant enactment
means an enactment so far as passed or made on or after 20th August 2025;
- Relevant function of the Bank of England
means—
- Relevant health record
means a health record which has been or is to be obtained by a data subject in the exercise of a data subject access right.
- relevant individual
means—
- relevant information society services
means information society services which involve the processing of personal data to which the UK GDPR applies;
- relevant international organisation
means an international organisation that carries out functions for any of the law enforcement purposes.
- relevant media organisation
means a body or other organisation whose activities consist of or include journalism, other than a broadcaster;
- relevant period
means— (a)...
- relevant person
means— (a) a person who, by reason of a permission under Part 4A of the Financial Services and Markets Act 2000, is able to carry on a corporate finance service without contravening the general prohibition;
- relevant personal data
means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.
- relevant processing of personal data
means—
- relevant provision of the GDPR
means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).”
- relevant record
means—
- Relevant record relating to a conviction or caution
means a record which—
- Relevant record relating to statutory functions
means a record which—
- relevant requirement
means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.”
- relevant social services functions
means functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3.
- relevant Welsh authority
has the same meaning as “relevant authority” in section 49(6) of the Local Government Act 2000, and “monitoring officer”, in relation to such an authority, has the same meaning as in Part 3 of that Act.
- requirement
includes a prohibition or restriction.
- Restriction of processing
means the marking of stored personal data with the aim of limiting its processing for the future.
- review period
means— (a) the period of 4 years beginning with the day on which Chapter 2 of Part 2 of this Act comes into force, and (b) each subsequent period of 5 years beginning with the day after the day on which the previous review period ended.
- Scottish public authority
has the same meaning as in the 2002 Act;
- sensitive personal data
means personal data the processing of which constitutes sensitive processing (see section 86(7)).
- Sensitive processing
has the meaning given in section 86(7).
- social care
has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).
- social protection
includes an intervention described in Article 2(b) of Regulation (EC) 458/2007 of the European Parliament and of the Council of 25 April 2007 on the European system of integrated social protection statistics (ESSPROS) as it had effect in EU law immediately before IP completion day.
- social security
includes any of the branches of social security listed in Article 3(1) of Regulation (EC) No. 883/2004 of the European Parliament and of the Council on the co-ordination of social security systems (as amended from time to time);
- social work authority
means a local authority for the purposes of the Social Work (Scotland) Act 1968.
- social work data
means personal data which— (a) is data to which paragraph 8 applies, but (b) is not education data or data concerning health.
- social work professional
means any of the following—
- special purposes proceedings
means legal proceedings against a controller or processor which relate, wholly or partly, to personal data processed for the special purposes and which are—
- specified
means specified in an assessment notice.
- standards of age-appropriate design of relevant information society services
means such standards of age-appropriate design of such services as appear to the Commission to be desirable having regard to the best interests of children;
- statutory function
means a function under or by virtue of an enactment.
- subordinate legislation
has the meaning given in the Interpretation Act 1978;
- teacher
includes— (a) in Great Britain, head teacher, and (b) in Northern Ireland, the principal of a school.
- the 1984 Act
means the Data Protection Act 1984;
- the 1998 Act
means the Data Protection Act 1998;
- the 2014 Regulations
means the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141);
- the 40-day period
means—
- the applicable time period
means the period of one month beginning with the relevant time, subject to subsection (14A);
- the applied GDPR
means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.
- the appropriate maximum
means the maximum amount specified by the Secretary of State by regulations.
- The Commission
means the Information Commission (see section 114A).
- The Data Protection Convention
means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed.
- the data protection legislation
has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
- the data protection principles
means the principles set out in— (a) Article 5(1) of the GDPR, (b) section 34(1) of the Data Protection Act 2018, and (c) section 85(1) of that Act;
- the effectiveness testing conditions
means the conditions in subsections (2) and (3).
- the eIDAS requirements
means the requirements of Chapter III of the eIDAS Regulation;
- the EITSET Regulations
means these Regulations;
- The EU GDPR
means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law.
- the GDPR
means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”
- The Law Enforcement Directive
means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.
- the law enforcement purposes
has the meaning given in section 31 of this Act;
- the listed GDPR provisions
means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- the listed provisions
means—
- the main data protection legislation
means the data protection legislation other than provision of or made under— (a) Chapter 6 or 8 of the UK GDPR, or (b) Parts 5 to 7 of this Act;
- the old data protection principles
means the principles set out in— (a) Part 1 of Schedule 1 to the 1998 Act, and (b) regulation 30 of the 2014 Regulations.
- the Refugee Convention
means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;
- the relevant day
means the day on which Schedule 12 to this Act comes into force.
- the relevant function
means, in relation to each education authority, its function under section 1 of the Education (Scotland) Act 1980 and section 7(1) of the Self-Governing Schools etc.
- the relevant Orders
means— (a) the Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184);
- the relevant period
means the period of 6 months ending with the day on which the opinion would be relied on.
- the relevant regulations
means— (a) the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191);
- the relevant subordinate legislation
means— (a) the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31);
- the relevant time
means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.
- the reporting period
means the period to which the report relates.
- the retail prices index
means—
- the sharing of personal data
means the disclosure of personal data by transmission, dissemination or otherwise making it available;
- the special purposes
means one or more of the following—
- the Trafficking Convention
means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.
- The UK GDPR
means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
- the UK national accreditation body
means the UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.
- the United Nations Convention on the Rights of the Child
means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.
- third country
means a country or territory outside the United Kingdom.
- trade association
includes a body representing controllers or processors.
- transfer
has the meaning given in article 2 of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190).
- tribunal
means any tribunal in which legal proceedings may be brought;
- urgency statement
means—
- war pension
has the same meaning as in section 25 of the Social Security Act 1989 (establishment and functions of war pensions committees).
- Withdrawal notice
has the meaning given in section 82C.
- working day
means any day other than—