Data Protection Act 2018 (c. 12)

SCHEDULES

SCHEDULE 6 U.K. The applied GDPR and the applied Chapter 2

PART 1 U.K. Modifications to the GDPR

Chapter I of the GDPR (general provisions) U.K.

7 U.K. For Article 2 (material scope) substitute—

“2 This Regulation applies to the processing of personal data to which Chapter 3 of Part 2 of the 2018 Act applies (see section 21 of that Act).”

Commencement Information

I1 Sch. 6 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

8 U.K. For Article 3 substitute—

“Article 3 U.K. Territorial application

Subsections (1), (2) and (7) of section 207 of the 2018 Act have effect for the purposes of this Regulation as they have effect for the purposes of that Act but as if the following were omitted—

(a) in subsection (1), the reference to subsection (3), and

(b) in subsection (7), the words following paragraph (d).”

Commencement Information

I2 Sch. 6 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

9 U.K. In Article 4 (definitions)—

(a) in paragraph (7) (meaning of “controller”), for “; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law” substitute “ , subject to section 6 of the 2018 Act (meaning of “controller”) ”;

(b) after paragraph (7) insert—

“(7A) “the 2018 Act” means the Data Protection Act 2018 as applied by section 22 of that Act and further modified by section 3 of that Act.”;

(c) omit paragraph (16) (meaning of “main establishment”);

(d) omit paragraph (17) (meaning of “representative”);

(e) in paragraph (20) (meaning of “binding corporate rules”), for “on the territory of a Member State” substitute “ in the United Kingdom ”;

(f) in paragraph (21) (meaning of “supervisory authority”)—

(i) after “a Member State” insert “ (other than the United Kingdom) ”;

(ii) for “Article 51” substitute “ Article 51 of the GDPR ”;

(g) after paragraph (21) insert—

“(21A) “the Commissioner” means the Information Commissioner (see section 114 of the 2018 Act);”;

(h) omit paragraph (22) (meaning of “supervisory authority concerned”);

(i) omit paragraph (23) (meaning of “cross-border processing”);

(j) omit paragraph (24) (meaning of “relevant and reasoned objection”);

(k) after paragraph (26) insert—

“(27) “the GDPR” has the meaning given in section 3(10) of the 2018 Act.

(28) “domestic law” has the meaning given in paragraph 3(3) of Schedule 6 to the 2018 Act.”

Commencement Information

I3 Sch. 6 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)