Defined terms — DPA 2018

Defined terms — Data Protection Act 2018

United Kingdom · ukpga/2018/12 · 3724 provisions

271 defined in this instrument.

accreditation authority — — the Commissioner, or the UK national accreditation body; “certification provider” and “UK national accreditation body” have the same meaning as in section 17 Schedule 5, paragraph 1(2)

added processing — a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a) Section 42A(2)

added processing — a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a) Section 91A(2)

adequacy decision — a decision made on the basis of— Article 45(3) of the EU GDPR, or Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; “binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR Schedule 21, Part 3, paragraph 9(7)

age-appropriate design — the design of services so that they are appropriate for use by, and meet the development needs of, children; “information society services” has the same meaning as in the UK GDPR, but does not include preventive or counselling services Section 123(7)

appropriate person — a person who the Secretary of State considers has appropriate experience and skills to produce a report described in subsection (1) Section 179(2)

Article 89 GDPR purposes — the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics); “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act) Schedule 19, Part 2, paragraph 253

Article 89 GDPR purposes — the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) Schedule 19, Part 2, paragraph 302(3)

biometric data — personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data Section 205(1)

carer — an individual who provides or intends to provide care for another individual other than— under or by virtue of a contract, or as voluntary work; “disability” has the same meaning as in the Equality Act 2010 (see section 6 of, and Schedule 1 to, that Act) Schedule 1, Part 2, paragraph 16(5)

caution — a caution given to a person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted; “conviction” has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (S.I. 1978/1908 (N.I. 27)) Schedule 18, paragraph 3(3)

certification provider — a person who issues certification for the purposes of Article 42 of the UK GDPR Section 17(8)

children's court officer — a person referred to in paragraph 8(1)(q), (r), (s), (t) or (u) of Schedule 3 Schedule 2, Part 3, paragraph 17(5)

children's rights organisation — a body or other organisation which— is active in representing the interests of children, and has objectives which are in the public interest; “trade association” includes a body representing controllers or processors Section 189(6)

competent authority — — a person specified or described in Schedule 7, and any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes Section 30(1)

controller — the competent authority which, alone or jointly with others— determines the purposes and means of the processing of personal data, or is the controller by virtue of subsection (2) Section 32(1)

corporate finance service — a service consisting in— underwriting in respect of issues of, or the placing of issues of, any instrument, services relating to such underwriting, or advice to undertakings on capital structure, industrial strategy and related matters and advice and service relating to mergers and the purchase of undertakings Schedule 2, Part 4, paragraph 21(4)

data concerning health — personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status; “enactment” includes— an enactment passed or made after this Act, an enactment comprised in subordinate legislation, an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales, an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ... an enactment comprised in, or in an instrument made under, Northern Ireland legislation; and any assimilated direct legislation Section 205(1)

data controller — a person who is a controller for the purposes of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act); “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act) Schedule 19, Part 2, paragraph 421

data protection functions — functions relating to the protection of individuals with respect to the processing of personal data; “mutual assistance in the enforcement of legislation for the protection of personal data” includes assistance in the form of notification, complaint referral, investigative assistance and information exchange Section 120(6)

data protection officer — a person designated as a data protection officer under the data protection legislation; “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act) Schedule 19, Part 2, paragraph 425(3)

data protection officer — a person designated as a data protection officer under the data protection legislation; for paragraph (d) substitute— “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act). omit sub-paragraphs (2) and (3), in sub-paragraph (4), for “the 1998 Act and any directly applicable EU instrument relating to data protection” substitute — the data protection legislation, or any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection. in sub-paragraph (6)(b), for “data controllers” substitute “ controllers Schedule 19, Part 2, paragraph 429(2)

data protection principle relating to accuracy — the principle in— Article 5(1)(d) of the UK GDPR, section 38(1) of this Act, or section 89 of this Act Section 151(8)

data protection principles — the principles set out in Article 5(1) of the GDPR; at the appropriate place insert— “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act) Schedule 19, Part 2, paragraph 318

Data subject — the identified or identifiable living individual to whom personal data relates Section 3(5)

data subject access right — a right under— Article 15 of the UK GDPR (right of access by the data subject); Article 20 of the UK GDPR (right to data portability); section 45 of this Act (law enforcement processing: right of access by the data subject); section 94 of this Act (intelligence services processing: right of access by the data subject) Schedule 18, paragraph 5

direct marketing — the communication (by whatever means) of advertising or marketing material which is directed to particular individuals Section 122(5)

domestic premises — premises, or a part of premises, used as a dwelling Section 146(12)

education data — personal data consisting of information which— constitutes an educational record, but is not data concerning health Schedule 3, Part 4, paragraph 17(1)

education-related worker — a person referred to in paragraph 14(4)(a) or (b) or 16(4)(a), (b) or (c) of Schedule 3 (educational records) Schedule 2, Part 3, paragraph 17(5)

educational record — a record to which paragraph 14, 15 or 16 applies Schedule 3, Part 4, paragraph 13

elected representative — — a member of the House of Commons; a member of the National Assembly for Wales; a member of the Scottish Parliament; a member of the Northern Ireland Assembly; . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 1972, namely— in England, a county council, a district council, a London borough council or a parish council; in Wales, a county council, a county borough council or a community council; an elected mayor of a local authority within the meaning of Part 1A or 2 of the Local Government Act 2000; a mayor for the area of a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009; a mayor for the area of a combined county authority established under section 9(1) of the Levelling-up and Regeneration Act 2023; the Mayor of London or an elected member of the London Assembly; an elected member of— the Common Council of the City of London, or the Council of the Isles of Scilly; an elected member of a council constituted under section 2 of the Local Government etc (Scotland) Act 1994; an elected member of a… Schedule 1, Part 2, paragraph 23(3)

employment — any employment, including— and “employee” is to be interpreted accordingly; work under a contract for services or as an office-holder, work under an apprenticeship, work experience as part of a training course or in the course of training for employment, and voluntary work, “relevant record” has the meaning given in Schedule 18 and references to a relevant record include— a part of such a record, and a copy of, or of part of, such a record Section 184(6)

enforcement powers — the powers under— Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR, sections 142 to 159 of this Act, paragraph 2(a), (b) and (c) of Schedule 13 to this Act, and Schedules 15 and 16 to this Act; “the law enforcement purposes” has the meaning given in section 31 of this Act Section 161A(6)

exam — an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity; “the relevant time” has the same meaning as in section 94 Schedule 11, paragraph 12(4)

Filing system — any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis Section 3(7)

Financial Ombudsman — the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act); the Schedule 2, Part 2, paragraph 12

financial year — a period of 12 months beginning with 1 April Schedule 12, paragraph 11(5)

financial year — — the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and each successive period of 12 months Schedule 12A, paragraph 22(6)

FOI public authority — — a public authority as defined in the Freedom of Information Act 2000, ... a Scottish public authority as defined in the Freedom of Information (Scotland) Act 2002 (asp 13) , or the Advanced Research and Invention Agency Section 21(5)

foreign designated authority — an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention; .. Schedule 13, paragraph 3

genetic data — personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question; “government department” includes the following (except in the expression “United Kingdom government department”)— a part of the Scottish Administration; a Northern Ireland department; the Welsh Government; a body or authority exercising statutory functions on behalf of the Crown Section 205(1)

good practice in direct marketing — such practice in direct marketing as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements mentioned in subsection (1)(a); “trade association” includes a body representing controllers or processors Section 122(5)

good practice in the processing of personal data — such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation; “trade association” includes a body representing controllers or processors Section 124A(7)

good practice in the sharing of personal data — such practice in the sharing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation Section 121(5)

Health and Social Care trust — a Health and Social Care trust established under the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1)) Schedule 3, Part 3, paragraph 7(1)

health or social care purposes — the purposes of— preventive or occupational medicine, the assessment of the working capacity of an employee, medical diagnosis, the provision of health care or treatment, the provision of social care, or the management of health care systems or services or social care systems or services Schedule 1, Part 1, paragraph 2(2)

health professional — any of the following— a registered medical practitioner; a registered nurse or midwife; a registered dentist within the meaning of the Dentists Act 1984 (see section 53 of that Act); a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989 (see section 36 of that Act); a registered osteopath with the meaning of the Osteopaths Act 1993 (see section 41 of that Act); a registered chiropractor within the meaning of the Chiropractors Act 1994 (see section 43 of that Act); a person registered as a member of a profession to which the Health ... Professions Order 2001 (S.I. 2002/254) for the time being extends; ... a registered pharmacist or a registered pharmacy technician within the meaning of the Pharmacy Order 2010 (S.I. 2010/231) (see article 3 of that Order); a registered person within the meaning of the Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) (see Article 2 of that Order); a child psychotherapist; a scientist employed by a health service body as head of a department. a person registered under the Anaesthesia Associates and Physician Associates Order 2024 Section 204(1)

health record — a record which— consists of data concerning health, and has been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates; “inaccurate”, in relation to personal data, means incorrect or misleading as to any matter of fact; “international obligation of the United Kingdom” includes— . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . an obligation that arises under an international agreement or arrangement to which the United Kingdom is a party Section 205(1)

health service body — any of the following— the Secretary of State in relation to the exercise of functions under section 2A or 2B of, or paragraph 7C, 8 or 12 of Schedule 1 to, the National Health Service Act 2006; a local authority in relation to the exercise of functions under section 2B or 111 of, or any of paragraphs 1 to 7B or 13 of Schedule 1 to, the National Health Service Act 2006; a National Health Service trust first established under section 25 of the National Health Service Act 2006; a Special Health Authority established under section 28 of the National Health Service Act 2006; an NHS foundation trust; the National Institute for Health and Care Excellence; NHS England; a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990; a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006; a National Health Service trust first established under section 18 of the National Health Service (Wales) Act 2006; a Special Health Authority established under section 22 of the National Health Service (Wales) Act 2006; a Health Board within the meaning of the National Health Service (Scotland) Act… Section 204(4)

HMRC — Her Majesty's Revenue and Customs. A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific). A person who contravenes subsection (1) is guilty of an offence. It is a defence for a person charged with an offence under this section to prove that the person reasonably believed— that the disclosure was lawful, or that the information had already lawfully been made available to the public. Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section. Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section. Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation. In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act) Section 195(2)

Identifiable living individual — a living individual who can be identified, directly or indirectly, in particular by reference to— an identifier such as a name, an identification number, location data or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual Section 3(3)

individual at economic risk — an individual who is less able to protect his or her economic well-being by reason of physical or mental injury, illness or disability Schedule 1, Part 2, paragraph 19(3)

instrument — an instrument listed in section C of Annex 1 to Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, and references to an instrument include an instrument not yet in existence but which is to be or may be created; “price” includes value Schedule 2, Part 4, paragraph 21(4)

insurance contract — a contract of general insurance or long-term insurance Schedule 1, Part 2, paragraph 20(5)

insurance purpose — — advising on, arranging, underwriting or administering an insurance contract, administering a claim under an insurance contract, or exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law Schedule 1, Part 2, paragraph 20(5)

intelligence service — — the Security Service; the Secret Intelligence Service; the Government Communications Headquarters Section 30(7)

intelligence service — — the Security Service; the Secret Intelligence Service; the Government Communications Headquarters Section 82(2)

international organisation — an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries; “Minister of the Crown” has the same meaning as in the Ministers of the Crown Act 1975 Section 205(1)

investigator of complaints against the financial regulators — the person appointed under section 84(1)(b) of the Financial Services Act 2012; “relevant authority” has the same meaning as in section 5 of the Local Government and Housing Act 1989, and “monitoring officer”, in relation to such an authority, means a person designated as such under that section; “relevant Welsh authority” has the same meaning as “relevant authority” in section 49(6) of the Local Government Act 2000, and “monitoring officer”, in relation to such an authority, has the same meaning as in Part 3 of that Act Schedule 2, Part 2, paragraph 12

key performance indicators — factors by reference to which the Commissioner’s performance can be measured most effectively Section 139A(3)

media organisation — a body or other organisation whose activities consist of or include journalism Section 177(2)

non-UK recipient — — a recipient in a third country, or an international organisation Section 80(2)

penalty — a penalty imposed by a penalty notice Schedule 16, paragraph 1

personal data — — personal data within the meaning of section 3(2) of the Data Protection Act 2018 which is subject to processing described in section 82(1) of that Act, and data relating to a deceased individual where the data would fall within paragraph (a) if it related to a living individual Schedule 19, Part 1, paragraph 200(2)

Personal data — any information relating to an identified or identifiable living individual (subject to subsection (14)(c)) Section 3(2)

Personal data breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed Section 33(3)

pre-commencement enactment — an enactment so far as passed or made before 20th August 2025 Section 183B(5)

pre-commencement enactment — an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3) Section 186A(5)

primary legislation — — an Act; an Act of the Scottish Parliament; a Measure or Act of the National Assembly for Wales; Northern Ireland legislation Section 211(7)

Principal Reporter — the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter Schedule 3, Part 3, paragraph 7(1)

prisoner — a person detained in a prison Schedule 1, Part 2, paragraph 25(3)

privileged communications — — communications made— between a professional legal adviser and the adviser's client, and in connection with the giving of legal advice to the client with respect to legal obligations, liabilities or rights, and communications made— between a professional legal adviser and the adviser's client or between such an adviser or client and another person, in connection with or in contemplation of legal proceedings, and for the purposes of such proceedings Section 133(5)

processor — any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller) Section 32(3)

processor — any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller) Section 83(3)

Profiling — any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements Section 33(4)

protected condition in Schedule 10 — a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3) Section 91A(2)

protected condition in Schedule 8 — a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6) Section 42A(2)

protective function — a function which is intended to protect members of the public against— dishonesty, malpractice or other seriously improper conduct, unfitness or incompetence, mismanagement in the administration of a body or association, or failures in services provided by a body or association Schedule 1, Part 2, paragraph 11(2)

public body — a body or other person whose functions are, or include, functions of a public nature, and a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1) Section 71A(3)

publish — make available to the public or a section of the public (and related expressions are to be read accordingly); “subordinate legislation” has the meaning given in the Interpretation Act 1978 Section 205(1)

pupil — — in relation to a school in England and Wales, a registered pupil within the meaning of the Education Act 1996, in relation to a school in Scotland, a pupil within the meaning of the Education (Scotland) Act 1980, and in relation to a school in Northern Ireland, a registered pupil within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)); “school”— in relation to England and Wales, has the same meaning as in the Education Act 1996, in relation to Scotland, has the same meaning as in the Education (Scotland) Act 1980, and in relation to Northern Ireland, has the same meaning as in the Education and Libraries (Northern Ireland) Order 1986; “teacher” includes— in Great Britain, head teacher, and in Northern Ireland, the principal of a school Schedule 3, Part 4, paragraph 17(1)

qualifying competent authority — a competent authority specified or described in regulations made by the Secretary of State Section 82(2A)

registered company — a company registered under the enactments relating to companies for the time being in force in the United Kingdom Section 141(6)

regulatory requirement — — a requirement imposed by legislation or by a person in exercise of a function conferred by legislation, or a requirement forming part of generally accepted principles of good practice relating to a type of body or an activity Schedule 1, Part 2, paragraph 12(2)

relevant alternative dispute resolution procedures — alternative dispute resolution procedures provided by persons who produce or enforce codes of practice for relevant media organisations Section 179(2)

relevant contravention — contravention in a manner described in paragraph 8 of Part 2 of Schedule 1 to the 1998 Act (sixth data protection principle) Schedule 20, Part 7, paragraph 29(2)

relevant enactment — any enactment other than— this Act, or the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4 : disclosures required by law) Schedule 19, Part 1, paragraph 28(3)

relevant enactment — an enactment so far as passed or made on or after 20th August 2025; “requirement” includes a prohibition or restriction Section 183A(4)

Relevant function of the Bank of England — — a function discharged by the Bank acting in its capacity as a monetary authority (as defined in section 244(2)(c) and (2A) of the Banking Act 2009); a public function of the Bank within the meaning of section 349 of the Financial Services and Markets Act 2000; a function conferred on the Prudential Regulation Authority by or under the Financial Services and Markets Act 2000 or by another enactment Schedule 2, Part 2, paragraph 9(2)

Relevant health record — a health record which has been or is to be obtained by a data subject in the exercise of a data subject access right Schedule 18, paragraph 2

relevant information society services — information society services which involve the processing of personal data to which the UK GDPR applies Section 123(7)

relevant international organisation — an international organisation that carries out functions for any of the law enforcement purposes Section 73(7)

relevant media organisation — a body or other organisation whose activities consist of or include journalism, other than a broadcaster Section 179(2)

relevant period — — the period of 18 months beginning when the Commissioner starts the first review under section 178, and the period of 12 months beginning when the Commissioner starts a subsequent review under that section; “the relevant review”, in relation to a relevant period, means the review under section 178 which the Commissioner must produce a report about by the end of that period Schedule 17, paragraph 1

relevant person — — a person who, by reason of a permission under Part 4A of the Financial Services and Markets Act 2000, is able to carry on a corporate finance service without contravening the general prohibition; an EEA firm of the kind mentioned in paragraph 5(a) or (b) of Schedule 3 to that Act which has qualified for authorisation under paragraph 12 of that Schedule, and may lawfully carry on a corporate finance service; a person who is exempt from the general prohibition in respect of any corporate finance service— as a result of an exemption order made under section 38(1) of that Act, or by reason of section 39(1) of that Act (appointed representatives); a person, not falling within paragraph (a), (b) or (c), who may lawfully carry on a corporate finance service without contravening the general prohibition; a person who, in the course of employment, provides to their employer a service falling within paragraph (b) or (c) of the definition of “corporate finance service Schedule 2, Part 4, paragraph 21(4)

relevant personal data — personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority Section 43(4)

relevant processing of personal data — — processing of personal data described in Article 2(1)(a) or (b) or (1A) of the UK GDPR, and processing of personal data to which Part 4 of this Act applies Section 183(2A)

relevant provision of the GDPR — any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law) Schedule 19, Part 1, paragraph 28(3)

relevant record — — a relevant health record (see paragraph 2), a relevant record relating to a conviction or caution (see paragraph 3), or a relevant record relating to statutory functions (see paragraph 4) Schedule 18, paragraph 1(1)

Relevant record relating to a conviction or caution — a record which— has been or is to be obtained by a data subject in the exercise of a data subject access right from a person listed in sub-paragraph (2), and contains information relating to a conviction or caution Schedule 18, paragraph 3(1)

Relevant record relating to statutory functions — a record which— has been or is to be obtained by a data subject in the exercise of a data subject access right from a person listed in sub-paragraph (2), and contains information relating to a relevant function in relation to that person Schedule 18, paragraph 4(1)

relevant requirement — the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards Schedule 19, Part 2, paragraph 258(2)

relevant social services functions — functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3 Schedule 2, Part 3, paragraph 17(5)

Restriction of processing — the marking of stored personal data with the aim of limiting its processing for the future Section 33(6)

Restriction of processing — the marking of stored personal data with the aim of limiting its processing for the future Section 84(6)

review period — — the period of 4 years beginning with the day on which Chapter 2 of Part 2 of this Act comes into force, and each subsequent period of 5 years beginning with the day after the day on which the previous review period ended Section 178(2)

review period — — the period of 3 years beginning when this Act is passed, and each subsequent period of 3 years Section 179(2)

sensitive personal data — personal data the processing of which constitutes sensitive processing (see section 86(7)) Schedule 10, paragraph 9(2)

sensitive processing — the processing of personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences etc) Schedule 19, Part 2, paragraph 415(5)

sensitive processing — — the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; the processing of genetic data for the purpose of uniquely identifying an individual; the processing of biometric data for the purpose of uniquely identifying an individual; the processing of data concerning health; the processing of data concerning an individual's sex life or sexual orientation; the processing of personal data as to— the commission or alleged commission of an offence by an individual, or proceedings for an offence committed or alleged to have been committed by an individual, the disposal of such proceedings or the sentence of a court in such proceedings Section 86(7)

social work authority — a local authority for the purposes of the Social Work (Scotland) Act 1968 Schedule 3, Part 3, paragraph 12(4)

social work data — personal data which— is data to which paragraph 8 applies, but is not education data or data concerning health Schedule 3, Part 3, paragraph 7(1)

social work professional — any of the following— a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017; a person registered as a social worker in the register maintained by Social Care Wales under section 80 of the Regulation and Inspection of Social Care (Wales) Act 2016 (anaw 2); a person registered as a social worker in the register maintained by the Scottish Social Services Council under section 44 of the Regulation of Care (Scotland) Act 2001 (asp 8); a person registered as a social worker in the register maintained by the Northern Ireland Social Care Council under section 3 of the Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.)) Section 204(2)

special purposes proceedings — legal proceedings against a controller or processor which relate, wholly or partly, to personal data processed for the special purposes and which are— proceedings under section 167 (including proceedings on an application under Article 79 of the UK GDPR), or proceedings under Article 82 of the UK GDPR or section 169 Section 174(2)

specified — specified in the following table— Schedule 1, Part 2, paragraph 8(2)

specified — specified in an assessment notice Section 146(12)

specified — specified in an enforcement notice Section 150(9)

standards of age-appropriate design of relevant information society services — such standards of age-appropriate design of such services as appear to the Commissioner to be desirable having regard to the best interests of children; “trade association” includes a body representing controllers or processors Section 123(7)

statutory function — a function under or by virtue of an enactment Section 30(7)

the 1984 Act — the Data Protection Act 1984 Schedule 20, Part 1, paragraph 1(1)

the 1998 Act — the Data Protection Act 1998 Schedule 20, Part 1, paragraph 1(1)

the 2014 Regulations — the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141); “data controller” has the same meaning as in the 1998 Act (see section 1 of that Act) Schedule 20, Part 1, paragraph 1(1)

the 40-day period — — if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days Section 119A(10)

the 40-day period — — if the code is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or if the code is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days Section 125(7)

the 40-day period — — if the guidance is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or if the guidance is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days Section 161(5)

The applicable time period — the period of one month beginning with the relevant time , subject to subsection (3A) Section 54(2)

the applicable time period — the period of one month beginning with the relevant time, subject to subsection (14A); “the relevant time”, in relation to a request under subsection (1), means the latest of the following— when the controller receives the request, when the fee (if any) is paid, and when the controller receives the information (if any) required under subsection (5) in connection with the request Section 94(14)

the applied GDPR — the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day Schedule 21, Part 1, paragraph 1

the appropriate maximum — the maximum amount specified by the Secretary of State by regulations Section 24(8)

The Commission — the Information Commission (see section 114A) Section 3(8A)

The Commissioner — the Information Commissioner (see section 114) Section 3(8)

The Data Protection Convention — the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed Section 3(13)

The data protection legislation — — the UK GDPR, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . this Act, and regulations made under this Act or the UK GDPR, ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Section 3(9)

the data protection principles — the principles set out in— Article 5(1) of the GDPR, and section 34(1) of the Data Protection Act 2018; “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); “the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act). In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted Schedule 19, Part 1, paragraph 58(7)

the data protection principles — the principles set out in— Article 5(1) of the GDPR, and section 34(1) of the Data Protection Act 2018 Schedule 19, Part 2, paragraph 311(2)

the data protection principles — the principles set out in— Article 5(1) of the GDPR, section 34(1) of the Data Protection Act 2018, and section 85(1) of that Act; “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act); “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted Schedule 19, Part 2, paragraph 317(3)

the data protection principles — the principles set out in— Article 5(1) of the GDPR, section 34(1) of the Data Protection Act 2018, and section 85(1) of that Act; “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act); “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted Schedule 19, Part 2, paragraph 320(3)

the data protection principles — the principles set out in— Article 5(1) of the GDPR, section 34(1) of the Data Protection Act 2018, and section 85(1) of that Act; “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act); “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted Schedule 19, Part 2, paragraph 343(3)

the direct marketing code — the codes respectively prepared under sections 52A and 52AA of the 1998 Act and issued under section 52B(5) of that Act Schedule 20, Part 6, paragraph 28(4)

the effectiveness testing conditions — the conditions in subsections (2) and (3) Section 172(1)

the eIDAS requirements — the requirements of Chapter III of the eIDAS Regulation Schedule 19, Part 2, paragraph 406

the EITSET Regulations — these Regulations; “withdrawal notice” has the meaning given in section 153A of the Data Protection Act 2018 (as inserted in that Act by this Schedule) Schedule 19, Part 2, paragraph 406

The EU GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law Section 3(10A)

the GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018. in the Welsh language text insert— Yn y rheoliad hwn, ystyr “y GDPR” (“the GDPR”) yw Rheoliad (EU) 2016/679 Senedd Ewrop a'r Cyngor dyddiedig 27 Ebrill 2016 ar ddiogelu personau naturiol o ran prosesu data personol a rhyddid symud data o'r fath (y Rheoliad Diogelu Data Cyffredinol), fel y'i darllenir ynghyd â Phennod 2 o Ran 2 o Ddeddf Diogelu Data 2018 Schedule 19, Part 2, paragraph 365(3)

The Law Enforcement Directive — Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA Section 3(12)

the listed GDPR provisions — — the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)— Article 13(1) to (3) (personal data collected from data subject: information to be provided); Article 14(1) to (4) (personal data collected other than from data subject: information to be provided); Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers); Article 16 (right to rectification); Article 17(1) and (2) (right to erasure); Article 18(1) (restriction of processing); Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing); Article 20(1) and (2) (right to data portability); Article 21(1) (objections to processing); Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)— Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article… Schedule 2, Part 1, paragraph 1

the listed GDPR provisions — the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)— Article 13(1) to (3) (personal data collected from data subject: information to be provided); Article 14(1) to (4) (personal data collected other than from data subject: information to be provided); Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers); Article 16 (right to rectification); Article 17(1) and (2) (right to erasure); Article 18(1) (restriction of processing); Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing); Article 20(1) and (2) (right to data portability); Article 21(1) (objections to processing); Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i) Schedule 2, Part 2, paragraph 6

the listed GDPR provisions — the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)— Article 13(1) to (3) (personal data collected from data subject: information to be provided); Article 14(1) to (4) (personal data collected other than from data subject: information to be provided); Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers); Article 16 (right to rectification); Article 17(1) and (2) (right to erasure); Article 18(1) (restriction of processing); Article 20(1) and (2) (right to data portability); Article 21(1) (objections to processing); Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (h) Schedule 3, Part 1, paragraph 1

the listed GDPR provisions — the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)— Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers); Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3) Schedule 4, paragraph 1

the listed provisions — — Chapter 2 of Part 4 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10; Chapter 3 of Part 4 (rights of data subjects); in Chapter 4 of Part 4 , section 108 (communication of personal data breach to the Commissioner) Schedule 11, paragraph 1

the main data protection legislation — the data protection legislation other than provision of or made under— Chapter 6 or 8 of the UK GDPR, or Parts 5 to 7 of this Act Section 183A(4)

the old data protection principles — the principles set out in— Part 1 of Schedule 1 to the 1998 Act, and regulation 30 of the 2014 Regulations Schedule 20, Part 1, paragraph 1(1)

the Refugee Convention — the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol Schedule 2, Part 1, paragraph 4A(5)

the relevant day — the day on which Schedule 12 to this Act comes into force Schedule 20, Part 6, paragraph 19(3)

the relevant function — in relation to each education authority, its function under section 1 of the Education (Scotland) Act 1980 and section 7(1) of the Self-Governing Schools etc. (Scotland) Act 1989 Schedule 3, Part 4, paragraph 15(4)

the relevant Orders — — the Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184); the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413); the Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414); the Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415); the Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416); Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419); Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864) Schedule 20, Part 2, paragraph 9(3)

the relevant period — the period— beginning when the amendments of section 45E of the Statistics and Registration Service Act 2007 in Schedule 19 to this Act come into force, and ending when the first revised statement is published under that section Schedule 20, Part 9, paragraph 49(3)

the relevant period — the period of 6 months ending with the day on which the opinion would be relied on Schedule 3, Part 2, paragraph 5(4)

the relevant period — the period of 6 months ending with the day on which the opinion would be relied on Schedule 3, Part 2, paragraph 6(4)

the relevant regulations — — the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191); regulation 4 of, and Schedule 1 to, the Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290); regulation 3 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244) Schedule 20, Part 2, paragraph 2(4)

the relevant subordinate legislation — — the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31); the Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910) Schedule 20, Part 7, paragraph 38(4)

the relevant time — the time when the repeal of section 56 of the 1998 Act comes into force Schedule 20, Part 2, paragraph 10(3)

the relevant time — the time when the repeal of section 7 of the 1998 Act comes into force; “UK competent authority” has the same meaning as in Part 4 of the 2014 Regulations (see regulation 27 of those Regulations) Schedule 20, Part 2, paragraph 2(4)

the relevant time — the time when the repeal of section 10 of the 1998 Act comes into force Schedule 20, Part 2, paragraph 3(2)

the relevant time — the time when the repeal of section 11 of the 1998 Act comes into force Schedule 20, Part 2, paragraph 4(2)

the relevant time — the time when the repeal of section 12 of the 1998 Act comes into force Schedule 20, Part 2, paragraph 5(2)

The relevant time — — in sub-paragraph (1), the time when the repeal of section 13 of the 1998 Act comes into force; in sub-paragraph (2), the time when the revocation of regulation 45 of the 2014 Regulation comes into force Schedule 20, Part 2, paragraph 6(3)

the relevant time — the time when the repeal of section 14 of the 1998 Act comes into force Schedule 20, Part 2, paragraph 7(3)

the relevant time — the time when the repeal of the provision of Part 2 of the 1998 Act in question comes into force Schedule 20, Part 2, paragraph 9(3)

the relevant time — the time when the repeal of section 28 of the 1998 Act comes into force Schedule 20, Part 5, paragraph 17(4)

the relevant time — the time when the repeal of section 28 of the 1998 Act comes into force Schedule 20, Part 5, paragraph 18(7)

the relevant time — the time when the repeal of Schedule 5 to the 1998 Act comes into force Schedule 20, Part 6, paragraph 22(2)

the relevant time — the time when the repeal of section 54 of the 1998 Act comes into force Schedule 20, Part 6, paragraph 24(4)

the relevant time — the time when the repeal of section 54 of the 1998 Act comes into force; “transfer” has the meaning given in article 2 of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190) Schedule 20, Part 6, paragraph 25(2)

the relevant time — the time when section 137 of this Act comes into force Schedule 20, Part 6, paragraph 26(2)

the relevant time — the time when the repeal of section 42 of the 1998 Act comes into force Schedule 20, Part 6, paragraph 27(3)

the relevant time — the time when the repeal of section 52E of the 1998 Act comes into force Schedule 20, Part 6, paragraph 28(4)

the relevant time — the time when the repeal of section 43 of the 1998 Act comes into force Schedule 20, Part 7, paragraph 30(3)

the relevant time — the time when the repeal of section 44 of the 1998 Act comes into force Schedule 20, Part 7, paragraph 31(3)

the relevant time — the time when the repeal of section 41A of the 1998 Act comes into force Schedule 20, Part 7, paragraph 32(6)

the relevant time — the time when the repeal of section 40 of the 1998 Act comes into force Schedule 20, Part 7, paragraph 33(2)

the relevant time — the time when the repeal of section 45 of the 1998 Act comes into force Schedule 20, Part 7, paragraph 34(2)

the relevant time — the time when the repeal of section 46 of the 1998 Act comes into force Schedule 20, Part 7, paragraph 35(2)

the relevant time — the time when the repeal of section 47 of the 1998 Act comes into force Schedule 20, Part 7, paragraph 36(2)

the relevant time — the time when the repeal of Schedule 9 to the 1998 Act comes into force Schedule 20, Part 7, paragraph 37(3)

the relevant time — the time when the repeal of section 55A of the 1998 Act comes into force Schedule 20, Part 7, paragraph 38(4)

the relevant time — the time when the repeal of section 48 of the 1998 Act comes into force Schedule 20, Part 7, paragraph 39(2)

the relevant time — the time when the repeal of the provision of Part 5 of the 1998 Act in question comes into force Schedule 20, Part 7, paragraph 40(2)

the relevant time — the time when the repeal of paragraph 7 of Schedule 6 to the 1998 Act comes into force Schedule 20, Part 7, paragraph 41(3)

the relevant time — the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force Schedule 20, Part 7, paragraph 42(2)

the relevant time — the time when the repeal of paragraph 7(1)(a) of Schedule 6 to the 1998 Act comes into force Schedule 20, Part 8, paragraph 46(2)

the relevant time — the time when the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act come into force Schedule 20, Part 9, paragraph 52(4)

the relevant time — the time when the repeal of paragraph 7(1)(b) of Schedule 6 to the 1998 Act comes into force Schedule 20, Part 9, paragraph 53(2)

the relevant time — the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force Schedule 20, Part 9, paragraph 54(2)

the relevant time — the time when the repeal of section 7 of the 1998 Act comes into force Schedule 20, Part 9, paragraph 55(2)

the relevant time — the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force Schedule 20, Part 9, paragraph 56(4)

the relevant time — the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force Schedule 20, Part 9, paragraph 60(4)

the relevant time — the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force Schedule 20, Part 9, paragraph 61(4)

The relevant time — the latest of the following— when the controller receives the request in question; when the controller receives the information (if any) requested in connection with a request under section 52(4); when the fee (if any) charged in connection with the request under section 53 is paid Section 54(3)

the reporting period — the period to which the report relates Section 139(1B)

the reporting period — the period to which the report relates Section 161A(6)

the retail prices index — — the general index of retail prices (for all items) published by the Statistics Board, or where that index is not published for a month, any substitute index or figures published by the Board Section 138(6)

the sharing of personal data — the disclosure of personal data by transmission, dissemination or otherwise making it available; “trade association” includes a body representing controllers or processors Section 121(5)

the special purposes — — the purposes of journalism; academic purposes; artistic purposes; literary purposes Schedule 1, Part 2, paragraph 13(4)

the special purposes — one or more of the following— the purposes of journalism; academic purposes; artistic purposes; literary purposes Schedule 2, Part 5, paragraph 26(1)

the special purposes — one or more of the following— the purposes of journalism; academic purposes; artistic purposes; literary purposes Section 174(1)

the Trafficking Convention — the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005 Schedule 2, Part 1, paragraph 4A(5)

The UK GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)) Section 3(10)

the UK national accreditation body — the UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 Section 17(8)

the United Nations Convention on the Rights of the Child — the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force Section 123(7)

third country — a country or territory outside the United Kingdom Section 120(6)

Third country — a country or territory outside the United Kingdom Section 33(7)

tribunal — any tribunal in which legal proceedings may be brought; “the Tribunal”, in relation to an application or appeal under this Act, means— the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, or the First-tier Tribunal, in any other case Section 205(1)

UK GDPR investigation — an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR) Section 161A(6)

urgency statement — — in relation to an information notice, a statement under section 142(7)(a), in relation to an assessment notice, a statement under section 146(8)(a) or (9)(d), in relation to an interview notice, a statement under section 148A(8)(a), and in relation to an enforcement notice, a statement under section 150(8)(a) Section 164(5)

working day — any day other than— Saturday or Sunday, Christmas Day or Good Friday, or a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom Schedule 5, paragraph 7