2.—(1) The following provisions of the 2018 Act, so far as not already in force (see section 212(2) of the 2018 Act), come into force on 25th May 2018—
(a)section 2 (protection of personal data);
(b)Part 2 (general processing) (including Schedules 1, 2, 3, 4, 5 and 6), other than paragraph 62 of Schedule 6;
(c)Part 3 (law enforcement processing) (including Schedules 7 and 8);
(d)Part 4 (intelligence services processing) (including Schedules 9, 10 and 11), other than the provisions listed in paragraph (2);
(e)Part 5 (the Information Commissioner) (including Schedules 12, 13 and 14), other than the provisions listed in—
(i)section 212(3) of the 2018 Act; and
(ii)regulation 3;
(f)Part 6 (enforcement) (including Schedules 15, 16 and 17), other than the provisions listed in section 212(3) of the 2018 Act;
(g)Part 7 (supplementary and final provision) (including Schedules 18, 19 and 20), other than the provisions listed in—
(i)paragraph (3); and
(ii)regulation 3.
(2) The provisions referred to in paragraph (1)(d) are—
(a)section 93 (right to information);
(b)section 102 (general obligations of the controller);
(c)section 103 (data protection by design);
(d)section 104 (joint controllers);
(e)section 105 (processors);
(f)section 108 (communication of a personal data breach).
(3) The provisions referred to in paragraph (1)(g)(i) are the following paragraphs in Schedule 19—
(a)paragraph 76;
(b)paragraph 201;
(c)paragraph 211;
(d)paragraph 227.