Watchtower/Law library/Regulation (EU) 2016/679 (UK GDPR)
As last captured

legislation

Regulation (EU) 2016/679 (UK GDPR)

UK GDPR establishes mandatory data protection principles and subject rights binding controllers under Art. 5 and Art. 6, and binds controllers and processors to contract and security duties under Art. 28 and Art. 32.

140 provisions in 3 parts · official text ↗

trbfpseuipsvmemccm
impact by vertical

Summary

What this law does

Regulates personal data processing across the United Kingdom, establishing core principles, lawful bases, data subject rights, security safeguards, governance frameworks, international transfer controls, and supervisory enforcement powers.

Why it matters to Signicat and its customers

No Signicat-specific relevance narrative is stored for this instrument; the stored applicability is shown below.

Who is bound: associations and other bodies representing categories of controllers or processors; certification bodies; controller; data protection officer; joint controllers; monitoring body; processor; Secretary of State · Regulators: Information Commission

Transportation
Mandatory data protection principles and subject rights govern processing passenger, driver, crew, and fleet personal data.
Banking Finance
Mandatory obligations govern processing customer financial and identity records, lawful bases, accountability, and technical security measures.
Public Sector Health
Mandatory requirements dictate lawful handling of public records, health and biometric data protections, and response timelines.
Energy Utility Telco
Mandatory compliance standards govern customer metering, communication data, processing records, and breach notification duties.
Insurance Pensions
Mandatory rules restrict processing special category health data, require documented processor contracts, and regulate profiling decisions.
Services
Mandatory duties apply to legal, accounting, and staffing firms managing client records, processor agreements, and identity verification.
Media Entertainment
Mandatory rules govern digital subscriber profiling, automated decision safeguards, and age consent verification for online services.
Manufacturing Construction
Mandatory standards regulate processing workforce vetting records, sub-processor security terms, and supply-chain personal data.
Commerce
Mandatory obligations govern consumer data handling, transparency disclosures, direct marketing objections, and customer access requests.

Key obligations each linked to the provision it comes from

Under (1), processing of personal data is lawful only if consent is given under (a), or processing is necessary for a contract under (b), legal obligation under (c), vital interests under (d), public interest or official authority under (e), recognised legitimate interest under (ea), or legitimate interests under (f). Under (3), bases for (c) and (e) must be laid down by domestic or international law. Under (5), recognised legitimate interests under (ea) must meet a condition in Annex 1.
Art. 6
data_protection.processor_controls
Under (1), processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for uniquely identifying a natural person, health data, or sex life/sexual orientation data is prohibited. Under (2), prohibition is lifted if processing is based on Article 6(1) and explicit consent is given under (a), employment/social security obligations apply under (b), vital interests are protected under (c), legitimate activities of not-for-profit bodies under (d) apply, data is manifestly made public under (e), legal claims apply under (f), substantial public interest under (g) applies, health/social care under (h) applies, public health under (i) applies, or archiving/research/statistical purposes under (j) apply.
Art. 9
data_protection.processor_controls
Under (1) and (2), the controller must provide information under Articles 13 and 14 and communications under Articles 15 to 22D and 34 in a concise, transparent, intelligible form, and facilitate data subject rights. Under (3) and (4), the controller must respond without undue delay and before the end of the applicable time period (Article 12A), stating reasons and complaint routes if no action is taken. Under (5), information and actions are free of charge unless requests are manifestly unfounded or excessive. Under (6), where reasonable doubts exist concerning the identity of the person making a request under Articles 15 to 22D, the controller may request additional information to confirm identity and delay dealing with the request until confirmed.
Art. 12
data_protection.processor_controlsidentity_proofing.data_verification
Under (1) and (2), when collecting personal data from a data subject, the controller must provide details of identity, DPO contact, processing purposes, legal basis, legitimate interests, recipients, international transfers, retention period or criteria, rights to access, rectification, erasure, restriction, objection, portability, consent withdrawal, complaints under sections 164A and 165 of the 2018 Act, contractual/statutory obligations, and automated decision-making logic and consequences under Article 22C. Under (3), prior notice must be given before further processing for a new purpose.
Art. 13
data_protection.processor_controlsretention.archive
Under (1) and (2), when personal data is not obtained from the data subject, the controller must provide controller identity, DPO details, purposes, legal basis, data categories, recipients, transfers, storage periods, rights, source of data, and automated decision-making details. Under (3), this information must be provided within a reasonable period (at latest within one month), or at first communication, or when data is first disclosed. Under (4), notice must precede further processing for a new purpose.
Art. 14
data_protection.processor_controlsretention.archive
Under (1), the controller must erase personal data without undue delay where data is no longer necessary, consent is withdrawn with no other ground, objection succeeds under Article 21, data was unlawfully processed, erasure is required by domestic law, data was collected under Article 8(1), or processing resulted from an allegation by a malicious person under (g) investigated with no further action. Under (2), a controller that made data public must take reasonable steps, including technical measures, to inform other controllers of erasure requests.
Art. 17
retention.archivedata_protection.processor_controls
Processing by a processor must be governed by a binding written contract or legal act under domestic law specifying the subject-matter, duration, nature, purpose, data types, categories of data subjects, and controller obligations. Under (3), the processor must process data solely on documented instructions from the controller, ensure confidentiality commitments under (b), take all Article 32 security measures under (c), observe sub-processor engagement conditions under (2) and (4), assist the controller with data subject rights under (e) and Articles 32 to 36 under (f), delete or return data upon service termination under (g), and facilitate audits under (h). Under (2), processors may not engage another processor without prior controller written authorisation.
Art. 28
data_protection.processor_controlssharing.secure
Under paragraph (1), absent approval regulations under Article 45A and compliance with Article 46, personal data transfers to a third country or international organisation may occur only on enumerated conditions including explicit consent after notice of risks, contract performance, vital interests, legal claims, public interest recognised in domestic law, or specified register consultation. Under paragraph (1) second subparagraph, if no other basis applies, a non-repetitive transfer concerning a limited number of data subjects may proceed for compelling legitimate interests where suitable safeguards exist, requiring Commission notification, data subject notice, and documentation in Article 30 records under paragraph (6).
Art. 49
data_protection.processor_controlsevidence.audit_trailretention.archivesharing.secure
Under (1.), statutory definitions apply for this Regulation: under (1) personal data means information relating to an identified or identifiable natural person; under (7) controller determines the purposes and means of processing; under (8) processor processes personal data on behalf of the controller; under (11) consent requires freely given, specific, informed, and unambiguous indication; under (14) biometric data means data resulting from specific technical processing relating to physical, physiological, or behavioural characteristics allowing unique identification. Under (2) to (7), specific interpretative rules govern scientific research, historical research, statistical purposes, and broad consent for scientific research.
Art. 4
data_protection.processor_controls
Controllers and processors, or their representatives, must maintain written records of processing activities under their responsibility containing the information specified in (1) and (2) respectively, including contact details, purposes, data categories, recipients, transfers, and security measures. Under (4), they must make the records available to the Commission on request.
Art. 30
data_protection.processor_controlsevidence.audit_trail
Under (1), the controller must consult the Commission prior to processing where an Article 35 impact assessment indicates unmitigated high risks. Under (3), the controller must provide information including respective responsibilities, purposes, means, safeguards, and the impact assessment. Under (2), the Commission must provide written advice within eight weeks, extendable by six weeks, and may use Article 58 powers. Under (4), the relevant authority must consult the Commission during preparation of legislative or regulatory measures relating to processing.
Art. 36
data_protection.processor_controls
Under (1) and (2), representative bodies may prepare, amend, or extend codes of conduct to specify the application of this Regulation. Under (4), codes must include mechanisms enabling an Article 41 accredited body to carry out mandatory compliance monitoring of controllers or processors that undertake to apply it. Under (5), draft codes, amendments, or extensions must be submitted to the Commission for an opinion and approval. Under (6), approved codes must be registered and published by the Commission. Under (3), controllers or processors not subject to this Regulation may adhere to approved codes to provide transfer safeguards under Article 46(2)(e).
Art. 40
data_protection.processor_controls
Under (1), accredited certification bodies with appropriate expertise issue and renew certification after informing the Commission. Accreditation may only be granted by the Commission under (a) or the UK national accreditation body under (b). Under (2), certification bodies must demonstrate independence and expertise under (a), respect approved criteria under (b), establish certification procedures under (c), establish complaint-handling structures under (d), and demonstrate absence of conflicts under (e). Under (4), accreditation is issued for a maximum period of five years and may be renewed. Under (5), certification bodies must provide reasons for granting or withdrawing certification to the Commission.
Art. 43
data_protection.processor_controls
Under (1A), a transfer of personal data to a third country or international organisation is made subject to appropriate safeguards only if safeguards are provided under (2) or (3) or Article 47A(4), and the controller or processor (or public body under (1A)(b)) reasonably and proportionately considers the data protection test in (6) is met. Safeguards without specific Commission authorisation under (2) include legally binding public body instruments, approved binding corporate rules under Article 47, standard data protection clauses from regulations or the Commission, or approved codes of conduct or certification mechanisms with binding commitments. Safeguards requiring Commission authorisation under (3) include custom contractual clauses or administrative arrangements.
Art. 46
data_protection.processor_controlssharing.secure
Under (1), the Commission must approve binding corporate rules for a group of undertakings or enterprises engaged in joint economic activity, provided they are legally binding and enforced across all members and employees under (a), confer enforceable data subject rights under (b), and meet all requirements in (2). Under (2), the rules must specify group structure, transfer categories, legal bindingness, general data protection principles, data subject rights (including automated decision safeguards and complaint rights), liability acceptance by the UK controller or processor for overseas breaches under (f), DPO monitoring tasks, compliance audit mechanisms under (j), change reporting, and personnel training under (n).
Art. 47
data_protection.processor_controlssharing.secure
Under paragraph (1), the Commission must monitor and enforce the Regulation, promote public and controller/processor awareness, conduct investigations including on information from foreign authorities, issue standard clauses under Article 28(8) and Article 46(2)(d), establish and maintain a list regarding data protection impact assessments under Article 35(4), approve certification criteria, maintain a public register under Article 42(8), accredit certification and monitoring bodies, authorise clauses and binding corporate rules, and keep internal records of infringements and Article 58(2) measures.
Art. 57
data_protection.processor_controlsevidence.audit_trail
Under paragraph (1), the Commission has investigative powers to order controllers and processors to supply required information, carry out data protection audits, and obtain access to personal data, processing equipment, and premises. Under paragraph (2), the Commission possesses corrective powers to issue warnings and reprimands, order compliance with data subject rights, mandate processing changes, direct breach communications, impose limitations or bans on processing, order rectification or erasure, withdraw certifications, impose administrative fines under Article 83, and order suspension of third-country data flows.
Art. 58
data_protection.processor_controlsevidence.audit_trail
The Commission must ensure administrative fines for infringements under paragraphs (4), (5) and (6) are effective, proportionate and dissuasive. Fines are imposed in addition to, or instead of, measures under points (a) to (h) and (j) of Article 58(2), with due regard to criteria in paragraph (2)(a) to (k). Under paragraph (4), infringements are subject to fines up to £8,700,000, or up to 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher. Under paragraphs (5) and (6), infringements or non-compliance with orders under Article 58(2) are subject to fines up to £17,500,000, or up to 4 % of total worldwide annual turnover of the preceding financial year, whichever is higher.
Art. 83
data_protection.processor_controls

Part summaries

0 of 0 parts have a verified summary.

L1 unavailable for current verification: the overall summary needs every part verified. Provisions and the verified summaries remain readable.

Verification findings (147)

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:eur/2016/679#article-1

synthesis coverage: missing evaluation uk:eur/2016/679#article-2

synthesis coverage: missing evaluation uk:eur/2016/679#article-3

synthesis coverage: missing evaluation uk:eur/2016/679#article-4

synthesis coverage: missing evaluation uk:eur/2016/679#article-4A

synthesis coverage: missing evaluation uk:eur/2016/679#article-5

synthesis coverage: missing evaluation uk:eur/2016/679#article-6

synthesis coverage: missing evaluation uk:eur/2016/679#article-7

synthesis coverage: missing evaluation uk:eur/2016/679#article-8

synthesis coverage: missing evaluation uk:eur/2016/679#article-8ZA

synthesis coverage: missing evaluation uk:eur/2016/679#article-8A

synthesis coverage: missing evaluation uk:eur/2016/679#article-9

synthesis coverage: missing evaluation uk:eur/2016/679#article-10

synthesis coverage: missing evaluation uk:eur/2016/679#article-11

synthesis coverage: missing evaluation uk:eur/2016/679#article-11A

synthesis coverage: missing evaluation uk:eur/2016/679#article-12

synthesis coverage: missing evaluation uk:eur/2016/679#article-12A.

synthesis coverage: missing evaluation uk:eur/2016/679#article-13

synthesis coverage: missing evaluation uk:eur/2016/679#article-14

synthesis coverage: missing evaluation uk:eur/2016/679#article-15

synthesis coverage: missing evaluation uk:eur/2016/679#article-16

synthesis coverage: missing evaluation uk:eur/2016/679#article-17

synthesis coverage: missing evaluation uk:eur/2016/679#article-18

synthesis coverage: missing evaluation uk:eur/2016/679#article-19

synthesis coverage: missing evaluation uk:eur/2016/679#article-20

synthesis coverage: missing evaluation uk:eur/2016/679#article-21

synthesis coverage: missing evaluation uk:eur/2016/679#article-22

synthesis coverage: missing evaluation uk:eur/2016/679#article-22A

synthesis coverage: missing evaluation uk:eur/2016/679#article-22B

synthesis coverage: missing evaluation uk:eur/2016/679#article-22C

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:eur/2016/679#article-22D

synthesis coverage: missing evaluation uk:eur/2016/679#article-23

synthesis coverage: missing evaluation uk:eur/2016/679#article-24

synthesis coverage: missing evaluation uk:eur/2016/679#article-25

synthesis coverage: missing evaluation uk:eur/2016/679#article-26

synthesis coverage: missing evaluation uk:eur/2016/679#article-27

synthesis coverage: missing evaluation uk:eur/2016/679#article-28

synthesis coverage: missing evaluation uk:eur/2016/679#article-29

synthesis coverage: missing evaluation uk:eur/2016/679#article-30

synthesis coverage: missing evaluation uk:eur/2016/679#article-31

synthesis coverage: missing evaluation uk:eur/2016/679#article-32

synthesis coverage: missing evaluation uk:eur/2016/679#article-33

synthesis coverage: missing evaluation uk:eur/2016/679#article-34

synthesis coverage: missing evaluation uk:eur/2016/679#article-35

synthesis coverage: missing evaluation uk:eur/2016/679#article-36

synthesis coverage: missing evaluation uk:eur/2016/679#article-37

synthesis coverage: missing evaluation uk:eur/2016/679#article-38

synthesis coverage: missing evaluation uk:eur/2016/679#article-39

synthesis coverage: missing evaluation uk:eur/2016/679#article-40

synthesis coverage: missing evaluation uk:eur/2016/679#article-41

synthesis coverage: missing evaluation uk:eur/2016/679#article-42

synthesis coverage: missing evaluation uk:eur/2016/679#article-43

synthesis coverage: missing evaluation uk:eur/2016/679#article-44

synthesis coverage: missing evaluation uk:eur/2016/679#article-44A

synthesis coverage: missing evaluation uk:eur/2016/679#article-45

synthesis coverage: missing evaluation uk:eur/2016/679#article-45A

synthesis coverage: missing evaluation uk:eur/2016/679#article-45B

synthesis coverage: missing evaluation uk:eur/2016/679#article-45C

synthesis coverage: missing evaluation uk:eur/2016/679#article-46

synthesis coverage: missing evaluation uk:eur/2016/679#article-47

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:eur/2016/679#article-47A

synthesis coverage: missing evaluation uk:eur/2016/679#article-48

synthesis coverage: missing evaluation uk:eur/2016/679#article-49

synthesis coverage: missing evaluation uk:eur/2016/679#article-49A

synthesis coverage: missing evaluation uk:eur/2016/679#article-50

synthesis coverage: missing evaluation uk:eur/2016/679#article-51

synthesis coverage: missing evaluation uk:eur/2016/679#article-52

synthesis coverage: missing evaluation uk:eur/2016/679#article-53

synthesis coverage: missing evaluation uk:eur/2016/679#article-54

synthesis coverage: missing evaluation uk:eur/2016/679#article-55

synthesis coverage: missing evaluation uk:eur/2016/679#article-56

synthesis coverage: missing evaluation uk:eur/2016/679#article-57

synthesis coverage: missing evaluation uk:eur/2016/679#article-58

synthesis coverage: missing evaluation uk:eur/2016/679#article-59

synthesis coverage: missing evaluation uk:eur/2016/679#article-60

synthesis coverage: missing evaluation uk:eur/2016/679#article-61

synthesis coverage: missing evaluation uk:eur/2016/679#article-62

synthesis coverage: missing evaluation uk:eur/2016/679#article-63

synthesis coverage: missing evaluation uk:eur/2016/679#article-64

synthesis coverage: missing evaluation uk:eur/2016/679#article-65

synthesis coverage: missing evaluation uk:eur/2016/679#article-66

synthesis coverage: missing evaluation uk:eur/2016/679#article-67

synthesis coverage: missing evaluation uk:eur/2016/679#article-68

synthesis coverage: missing evaluation uk:eur/2016/679#article-69

synthesis coverage: missing evaluation uk:eur/2016/679#article-70

synthesis coverage: missing evaluation uk:eur/2016/679#article-71

synthesis coverage: missing evaluation uk:eur/2016/679#article-72

synthesis coverage: missing evaluation uk:eur/2016/679#article-73

synthesis coverage: missing evaluation uk:eur/2016/679#article-74

synthesis coverage: missing evaluation uk:eur/2016/679#article-75

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:eur/2016/679#article-76

synthesis coverage: missing evaluation uk:eur/2016/679#article-77

synthesis coverage: missing evaluation uk:eur/2016/679#article-78

synthesis coverage: missing evaluation uk:eur/2016/679#article-79

synthesis coverage: missing evaluation uk:eur/2016/679#article-80

synthesis coverage: missing evaluation uk:eur/2016/679#article-81

synthesis coverage: missing evaluation uk:eur/2016/679#article-82

synthesis coverage: missing evaluation uk:eur/2016/679#article-83

synthesis coverage: missing evaluation uk:eur/2016/679#article-84

synthesis coverage: missing evaluation uk:eur/2016/679#article-84A

synthesis coverage: missing evaluation uk:eur/2016/679#article-84B

synthesis coverage: missing evaluation uk:eur/2016/679#article-84C

synthesis coverage: missing evaluation uk:eur/2016/679#article-84D

synthesis coverage: missing evaluation uk:eur/2016/679#article-85

synthesis coverage: missing evaluation uk:eur/2016/679#article-86

synthesis coverage: missing evaluation uk:eur/2016/679#article-86A

synthesis coverage: missing evaluation uk:eur/2016/679#article-87

synthesis coverage: missing evaluation uk:eur/2016/679#article-88

synthesis coverage: missing evaluation uk:eur/2016/679#article-89

synthesis coverage: missing evaluation uk:eur/2016/679#article-90

synthesis coverage: missing evaluation uk:eur/2016/679#article-91

synthesis coverage: missing evaluation uk:eur/2016/679#article-91A

synthesis coverage: missing evaluation uk:eur/2016/679#article-92

synthesis coverage: missing evaluation uk:eur/2016/679#article-93

synthesis coverage: missing evaluation uk:eur/2016/679#article-94

synthesis coverage: missing evaluation uk:eur/2016/679#article-95

synthesis coverage: missing evaluation uk:eur/2016/679#article-96

synthesis coverage: missing evaluation uk:eur/2016/679#article-97

synthesis coverage: missing evaluation uk:eur/2016/679#article-98

synthesis coverage: missing evaluation uk:eur/2016/679#article-99

synthesis coverage: missing/unverified L2 annex-1

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-1

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-2

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-3

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-4

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-5

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-6

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-7

synthesis coverage: missing evaluation uk:eur/2016/679#annex-1-8

synthesis coverage: missing/unverified L2 annex-2

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-1

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-2

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-3

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-4

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-5

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-6

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-7

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-8

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-9

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-10

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-11

synthesis coverage: missing evaluation uk:eur/2016/679#annex-2-12

Instrument tier unavailable

Change history as published

Art. 44 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 2(1); S.I. 2026/82, reg. 2(z9)

Art. 45 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 3; S.I. 2026/82, reg. 2(z9)

Art. 48 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 41 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 53 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 47 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 54 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 48 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 55 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 50 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 56 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 51 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 59 omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 12; S.I. 2025/904, reg. 2(y)

Ch. 7 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 55 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1) · repeated 17×

Art. 77 omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 103(6), 142(1); S.I. 2026/82, reg. 3(a) (with reg. 7)

Art. 81 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 60 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 87 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 67 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 88 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 68 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 89 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 86(4), 142(1); S.I. 2026/82, reg. 2(n)

Art. 90 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 70 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 91 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 71 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Ch. 10 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 72 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1) · repeated 2×

Art. 97 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 76 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 98 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 77 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Art. 99 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 78 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Pending effects amendments not yet applied to this text

Art. 57(3)(4) word substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 41(3)para. 41(4)(z1)(i) · Effective date unknown · Art. 57

Art. 57(2) word substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 41(3)para. 41(4)(z1)(ii) · Effective date unknown · Art. 57

Art. 77 heading word substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 41(3)para. 41(4)(z3)(i) · Effective date unknown · Art. 77

Art. 77(1)(2) word substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 41(3)para. 41(4)(z3)(ii) · Effective date unknown · Art. 77

Art. 80(2) word substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 41(3)para. 41(4)(z6) · Effective date unknown · Art. 80

Full TOC · table of contents Expand all parts

3 parts · 140 provisions. Open a provision for its text and, where available, its one-line summary.

· 120 provisions
Article 1 Subject-matter and objectives
Article 2 Material scope
Article 3 Territorial scope
Article 4 Definitions
Article 4A Periods of time
Article 5 Principles relating to processing of personal data
Article 6 Lawfulness of processing
Article 7 Conditions for consent
Article 8 Conditions applicable to child's consent in relation to information society services
Article 8ZA Child’s consent in relation to information society services: age verification
Article 8A Purpose limitation: further processing
Article 9 Processing of special categories of personal data
Article 10 Processing of personal data relating to criminal convictions and offences
Article 11 Processing which does not require identification
Article 11A Further provision about processing of special categories of personal data
Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject
Article 12A. Meaning of “applicable time period”
Article 13 Information to be provided where personal data are collected from the data subject
Article 14 Information to be provided where personal data have not been obtained from the data subject
Article 15 Right of access by the data subject
Article 16 Right to rectification
Article 17 Right to erasure (‘right to be forgotten’)
Article 18 Right to restriction of processing
Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing
Article 20 Right to data portability
Article 21 Right to object
Article 22 Automated individual decision-making, including profiling
Article 22A Automated processing and significant decisions
Article 22B Restrictions on automated decision-making
Article 22C Safeguards for automated decision-making
Article 22D Further provision about automated decision-making
Article 23 Restrictions
Article 24 Responsibility of the controller
Article 25 Data protection by design and by default
Article 26 Joint controllers
Article 27 Representatives of controllers or processors not established in the United Kingdom
Article 28 Processor
Article 29 Processing under the authority of the controller or processor
Article 30 Records of processing activities
Article 31 Cooperation with the Commission
Article 32 Security of processing
Article 33 Notification of a personal data breach to the Commission
Article 34 Communication of a personal data breach to the data subject
Article 35 Data protection impact assessment
Article 36 Prior consultation
Article 37 Designation of the data protection officer
Article 38 Position of the data protection officer
Article 39 Tasks of the data protection officer
Article 40 Codes of conduct
Article 41 Monitoring of approved codes of conduct
Article 42 Certification
Article 43 Certification bodies
Article 44 General principle for transfers
Article 44A General principles for transfers
Article 45 Transfers on the basis of an adequacy decision
Article 45A Transfers approved by regulations
Article 45B The data protection test
Article 45C Transfers approved by regulations: monitoring
Article 46 Transfers subject to appropriate safeguards
Article 47 Transfers subject to appropriate safeguards: Binding corporate rules
Article 47A Transfers subject to appropriate safeguards: further provision
Article 48 Transfers or disclosures not authorised by Union law
Article 49 Derogations for specific situations
Article 49A Restriction in the public interest
Article 50 International cooperation for the protection of personal data
Article 51 Monitoring the application of this Regulation
Article 52 Independence
Article 53 General conditions for the members of the supervisory authority
Article 54 Rules on the establishment of the supervisory authority
Article 55 Competence
Article 56 Competence of the lead supervisory authority
Article 57 Tasks
Article 58 Powers
Article 59 Activity reports
Article 60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned
Article 61 Mutual assistance
Article 62 Joint operations of supervisory authorities
Article 63 Consistency mechanism
Article 64 Opinion of the Board
Article 65 Dispute resolution by the Board
Article 66 Urgency procedure
Article 67 Exchange of information
Article 68 European Data Protection Board
Article 69 Independence
Article 70 Tasks of the Board
Article 71 Reports
Article 72 Procedure
Article 73 Chair
Article 74 Tasks of the Chair
Article 75 Secretariat
Article 76 Confidentiality
Article 77 Right to lodge a complaint with the Commissioner
Article 78 Right to an effective judicial remedy against the Commission
Article 79 Right to an effective judicial remedy against a controller or processor
Article 80 Representation of data subjects
Article 81 Suspension of proceedings
Article 82 Right to compensation and liability
Article 83 General conditions for imposing administrative fines
Article 84 Penalties
Article 84A Research, archives and statistics
Article 84B Additional requirements when processing for RAS purposes
Article 84C Appropriate safeguards
Article 84D Appropriate safeguards: further provision
Article 85 Processing and freedom of expression and information
Article 86 Processing and public access to official documents
Article 86A Processing and national security and defence
Article 87 Processing of the national identification number
Article 88 Processing in the context of employment
Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
Article 90 Obligations of secrecy
Article 91 Existing data protection rules of churches and religious associations
Article 91A Regulations made by Secretary of State
Article 92 Exercise of the delegation
Article 93 Committee procedure
Article 94 Repeal of Directive 95/46/EC
Article 95 Relationship with domestic law made before IP completion day implementing Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector
Article 96 Relationship with previously concluded Agreements
Article 97 Commission reports
Article 98 Review of other Union legal acts on data protection
Article 99 Entry into force and application
ANNEX 1 · 8 provisions
1 Disclosure for purposes of processing described in Article 6(1)(e)
2 National security, public security and defence
3 Emergencies
4
5 Crime
6 Safeguarding vulnerable individuals
7
8
ANNEX 2 · 12 provisions
1 Disclosure for purposes of processing described in Article 6(1)(e)
2 Disclosure for the purposes of archiving in the public interest
3 Public security
4 Emergencies
5
6 Crime
7 Protection of vital interests of data subjects and others
8 Safeguarding vulnerable individuals
9
10
11 Taxation
12 Legal obligations

Impact profile

Transportation
3
Banking finance
3
Public sector health
3
Energy, utilities & telco
3
Insurance pensions
3
Services
3
Media entertainment
3
Manufacturing construction
3
Commerce
3

Dimensions

Mechanism strength
2
Signicat obligation
3
Urgency
Pending

Penalties

Administrative fines up to £8,700,000 or up to £17,500,000 (or statutory turnover percentages) under Art. 83.

Definitions

personal data
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier”
Art. 4
processing
“any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination”
Art. 4
controller
“the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (but see section 6 of the 2018 Act)”
Art. 4
processor
“a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller”
Art. 4
biometric data
“personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”
Art. 4
pseudonymisation
“the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately”
Art. 4
personal data breach
“a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”
Art. 4
applicable time period
“the period of one month beginning with the relevant time, subject to paragraph 3”
Art. 12A.

References

uk:asp/2010/13 (unregistered reference)

uk:eudr/1995/46 (unregistered reference)

uk:eudr/2002/58 (unregistered reference)

uk:nia/2022/17 (unregistered reference)

uk:ukpga/2018/12

uk:uksi/2018/506