Provisions coming into force on 25th May 20182

1

The following provisions of the 2018 Act, so far as not already in force (see section 212(2) of the 2018 Act), come into force on 25th May 2018—

a

section 2 (protection of personal data);

b

Part 2 (general processing) (including Schedules 1, 2, 3, 4, 5 and 6), other than paragraph 62 of Schedule 6;

c

Part 3 (law enforcement processing) (including Schedules 7 and 8);

d

Part 4 (intelligence services processing) (including Schedules 9, 10 and 11), other than the provisions listed in paragraph (2);

e

Part 5 (the Information Commissioner) (including Schedules 12, 13 and 14), other than the provisions listed in—

i

section 212(3) of the 2018 Act; and

ii

regulation 3;

f

Part 6 (enforcement) (including Schedules 15, 16 and 17), other than the provisions listed in section 212(3) of the 2018 Act;

g

Part 7 (supplementary and final provision) (including Schedules 18, 19 and 20), other than the provisions listed in—

i

paragraph (3); and

ii

regulation 3.

2

The provisions referred to in paragraph (1)(d) are—

a

section 93 (right to information);

b

section 102 (general obligations of the controller);

c

section 103 (data protection by design);

d

section 104 (joint controllers);

e

section 105 (processors);

f

section 108 (communication of a personal data breach).

3

The provisions referred to in paragraph (1)(g)(i) are the following paragraphs in Schedule 19—

a

paragraph 76;

b

paragraph 201;

c

paragraph 211;

d

paragraph 227.