Secondary Legislation under Data Protection Act 2018

Showing 14 Statutory Instruments linked to this bill.

Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026

Reference: 2026 No. 425
Laid before Parliament: 21 April 2026
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations require the Information Commissioner (“the Commissioner”) to prepare a code of practice on the processing of personal data under relevant data protection legislation in relation to developing and using artificial intelligence and automated decision-making. Relevant data protection legislation is defined in regulation 2 as the UK GDPR and the Data Protection Act 2018 (“the 2018 Act”), except Part 4 (intelligence services processing).

Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025

Reference: 2025 No. 1331
Laid before Parliament: 17 December 2025
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data (Use and Access) Act 2025 Data Protection Act 2018 Police and Criminal Evidence Act 1984
SI explanatory text These Regulations make amendments which are consequential on provisions in the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). They also make related changes in relation to recordable offences.

Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025

Laid before Parliament: 7 July 2025
Procedure: Draft affirmative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text Sections 89 and 90 of the Data (Use and Access) Act (c. 18) (“the DUAA”) amend the Data Protection Act 2018 (c. 12) (“the DPA”) to enable joint processing between qualifying competent authorities and intelligence services, under Part 4 of the DPA. This enables the controllers, previously unable to process jointly, to process personal data within a single, common regime. The controls and safeguards under Part 4 of the DPA will apply to all such joint processing. Section 89(2) of the DUAA amends section 82 of the DPA, widening the scope of Part 4 of the DPA. Previously, Part 4 of the DPA only applied to processing by or on behalf of the intelligence services. As amended, section 82 also applies Part 4 of the DPA to the processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice. Section 89(2) of the DUAA inserts new subsection (2A) into section 82 of the DPA, which grants a power to the Secretary of State to make regulations to specify and describe which competent authorities (as defined in section 30 of the DPA) are “qualifying competent authorities”, and so able to apply for or be issued with a designation notice.

Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025

Reference: 2025 No. 89
Laid before Parliament: 30 January 2025
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations specify the Isle of Man as a third country which provides an adequate level of protection of personal data for the purposes of Part 3 (law enforcement processing) of the Data Protection Act 2018 (c. 12).

Data Protection (Charges and Information) (Amendment) Regulations 2025

Reference: 2025 No. 63
Laid before Parliament: 27 January 2025
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text The Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) (“the 2018 Regulations”) set out the circumstances in which data controllers are required to pay a charge to the Information Commissioner. Regulation 2 of the 2018 Regulations requires a data controller to pay an annual charge to the Information Commissioner unless all of the processing by the data controller is exempt processing. Each annual period for which a charge must be paid is described as a “charge period”. Regulation 3 of the 2018 Regulations makes provision for the amount of the annual charge, prescribing three tiers of charges according to criteria relating to a data controller’s turnover and number of members of staff (or only members of staff, for a public authority). Charities and small occupational pension schemes are included in the lowest tier. The charge is reduced if a data controller pays the charge by direct debit.

Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Laid before Parliament: 31 January 2024
Procedure: Draft affirmative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations amend the immigration exemption in Part 1 of Schedule 2 to the Data Protection Act 2018 (c. 12) (“the 2018 Act”). These amendments are made in consequence of the judgment of the Court of Appeal in the case of R. (on the application of the 3million and Open Rights Group) v. Secretary of State for the Home Department and Secretary of State for Science, Innovation and Technology (formerly Secretary of State for Digital, Culture, Media and Sport), and The Information Commissioner as an Interested Party ([2023] EWCA Civ 1474).

Data Protection (Law Enforcement) (Adequacy) (Bailiwick of Jersey) Regulations 2023

Reference: 2023 No. 1221
Laid before Parliament: 22 November 2023
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations specify the Bailiwick of Jersey (“Jersey”) as a third country which provides an adequate level of protection of personal data for the purposes of Part 3 (law enforcement processing) of the Data Protection Act 2018 (c. 12).

Data Protection (Adequacy) (United States of America) Regulations 2023

Reference: 2023 No. 1028
Laid before Parliament: 21 September 2023
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations specify the United States of America as a country which provides an adequate level of protection of personal data for certain transfers for the purposes of Part 2 of the Data Protection Act 2018 (“the 2018 Act”) and the UK GDPR (defined in section 3 of the 2018 Act). This means that personal data which will be in the scope of the EU-US Data Privacy Framework Principles can be transferred to persons in the United States of America who participate in the UK Extension to the EU-US Data Privacy Framework without the need for any specific authorisation. “Personal data” is defined in Article 4(1) of the UK GDPR and has the same meaning in Part 2 of the 2018 Act by virtue of section 5 of that Act.

Data Protection (Law Enforcement) (Adequacy) (Bailiwick of Guernsey) Regulations 2023

Reference: 2023 No. 744
Laid before Parliament: 7 July 2023
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations specify the Bailiwick of Guernsey (“Guernsey”) as a third country which provides an adequate level of protection of personal data for the purposes of Part 3 (law enforcement processing) of the Data Protection Act 2018 (c. 12).

Data Protection Act 2018 (Transitional Provision) Regulations 2023

Reference: 2023 No. 414
Laid before Parliament: 6 April 2023
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations amend paragraph 14 of Schedule 20 to the Data Protection Act 2018 (c. 12) (“the 2018 Act”).

Data Protection (Adequacy) (Republic of Korea) Regulations 2022

Reference: 2022 No. 1213
Laid before Parliament: 23 November 2022
Procedure: Made negative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations specify the Republic of Korea as a country which provides an adequate level of protection of personal data for the purposes of Part 2 of the Data Protection Act 2018 (“the 2018 Act”) and the UK GDPR (defined in section 3 of the 2018 Act). This means that personal data can be transferred to natural or legal persons in the Republic of Korea who are subject to Korean data protection legislation (specifically the Personal Information Protection Act) without the need for any specific authorisation. “Personal data” is defined in Article 4(1) of the UK GDPR and has the same meaning in Part 2 of the 2018 Act by virtue of section 5 of that Act.

Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022

Laid before Parliament: 10 December 2021
Procedure: Draft affirmative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text These Regulations amend the immigration exemption in paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018 (c. 12) (“the 2018 Act”). These amendments are made in consequence of the judgment of the Court of Appeal in the case of R (on the application of Open Rights Group and another) v Secretary of State for the Home Department and another (Liberty and another intervening) ([2021] EWCA Civ 800).

Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019

Laid before Parliament: 19 December 2018
Procedure: Draft affirmative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018 European Union (Withdrawal) Act 2018

Data Protection (Charges and Information) (Amendment) Regulations 2019

Laid before Parliament: 17 December 2018
Procedure: Draft affirmative
Parliament Page Legislation Text
Enabling Acts
Data Protection Act 2018
SI explanatory text The Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) set out the circumstances in which data controllers are required to pay a charge to the Information Commissioner. Regulation 2 of those Regulations requires a data controller to pay an annual charge to the Information Commissioner unless all the processing of personal data by the data controller is exempt processing. “Exempt processing” has the meaning given in the Schedule to those Regulations.