accredited conformity assessment body — a conformity assessment body that is accredited by the UK national accreditation body in accordance with Article 5 of the Accreditation Regulation as competent to carry out assessments of whether digital verification services are provided in accordance with the DVS trust framework Section 33(6)

added processing — a description of processing which is subject to the prohibition in Article 9(1) by virtue of provision made under paragraph 1(a). Regulations made under this Article (in reliance on Article 91A(4)(b)) may amend section 5, 205 or 206 of the 2018 Act (interpretation). Regulations under this Article are subject to the affirmative resolution procedure Section 74(1)

added processing — a description of processing that is sensitive processing for the purposes of section 202 by virtue of provision made under subsection (1)(a) Section 74(12)

added processing — a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a) Section 74(5)

added processing — a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a) Section 74(8)

AI system — a machine-based system that, from the input it receives, can infer how to— with a view to achieving an explicit or implicit objective; generate predictions, digital content, recommendations, decisions or other similar outputs, or influence a physical or virtual environment Section 135(4)

application programming interface — a facility for allowing software to make use of facilities contained in other software Section 25(1)

appropriate registration officer — — in the case of a live-birth, the Registrar General, a superintendent registrar or a registrar; in the case of a still-birth— the Registrar General, or a registrar acting at the time of the registration of the still-birth or with the consent of the Registrar General Schedule 3, Part 1, paragraph 10(3)

approved medical research — medical research carried out by a person who has approval to carry out that research from— a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, or a body appointed by any of the following for the purpose of assessing the ethics of research involving individuals— the Secretary of State, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department; a relevant NHS body; United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965; an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act) Section 86(2)

body — a body corporate or a Scottish partnership; “officer”, in relation to a body, means— in relation to a body corporate— a director, manager, secretary or other similar officer of the body or any person purporting to act in such capacity, and where the affairs of the body are managed by its members, a member; or in relation to a Scottish partnership, a partner or any person purporting to act as a partner Schedule 13, paragraph 15(4B)

charity — — and, in relation to such a charity, institution or body, “charitable purpose” has the meaning given in the relevant Act. a charity as defined in section 1(1) of the Charities Act 2011, a charity as defined in section 1(1) of the Charities Act (Northern Ireland) 2008 (c. 12 (N.I.)), including an institution treated as such a charity for the purposes of that Act by virtue of the Charities Act 2008 (Transitional Provision) Order (Northern Ireland) 2013 (S.R. (N.I.) 2013 No. 211), and a body entered in the Scottish Charity Register, other than a body which no longer meets the charity test in section 7 of the Charities and Trustee Investment (Scotland) Act 2005 (asp 10) Section 114(4)

combined NUAR expenses — the sum of— expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under this Part (including expenses not directly connected with the keeping of NUAR), and expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under Articles 45A to 45I of, and Schedule 2ZA to, the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (including expenses not directly connected with the keeping of the register kept under Article 45A(1) of that Order) Section 106E(10)

combined NUAR expenses — the sum of— expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under this Part (including expenses not directly connected with the keeping of NUAR), and expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under Articles 45A to 45I of, and Schedule 2ZA to, the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (including expenses not directly connected with the keeping of the register kept under Article 45A(1) of that Order) Section 56(1)

combined NUAR expenses — the sum of— expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under a NUAR provision (including expenses not directly connected with the keeping of NUAR), and expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under Part 3A of the New Roads and Street Works Act 1991 (including expenses not directly connected with the keeping of the register kept under section 106A(1) of that Act) Section 58(3)

combined NUAR income — the sum of— income received by the Secretary of State from fees payable under regulations under subsection (1), and income received by the Secretary of State from fees payable under regulations under Article 45E(1) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) Section 106E(10)

combined NUAR income — the sum of— income received by the Secretary of State from fees payable under regulations under subsection (1), and income received by the Secretary of State from fees payable under regulations under Article 45E(1) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)). The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes— assisting the Secretary of State in determining the provision that it is appropriate for regulations under section 106E(1) or a statement under section 106E(4) to make; assisting the Secretary of State in determining whether it is appropriate to make changes to such provision. The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes— ascertaining whether a fee is payable by a person under regulations under section 106E(1); working out the amount of a fee payable by a person. Regulations under subsection (1) or (2) may require an undertaker to notify… Section 56(1)

combined NUAR income — the sum of— income received by the Secretary of State from fees payable under regulations under paragraph (1), and income received by the Secretary of State from fees payable under regulations under section 106E(1) of the New Roads and Street Works Act 1991. The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes— assisting the Secretary of State in determining the provision that it is appropriate for regulations under Article 45E(1) or a statement under Article 45E(4) to make; assisting the Secretary of State in determining whether it is appropriate to make changes to such provision. The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes— ascertaining whether a fee is payable by a person under regulations under Article 45E(1); working out the amount of a fee payable by a person. Regulations under paragraph (1) or (2) may require an undertaker to notify the Secretary of State of any changes to… Section 58(3)

Consultation Paper responses — responses to the Copyright and AI Consultation Paper received by the Secretary of State on or before 25 February 2025 Section 136(8)

copyright — the property right which subsists in accordance with Part 1 of the Copyright, Designs and Patents Act 1988; “copyright work” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988 Section 136(8)

customer data — information relating to a customer of a trader, including— information relating to goods, services and digital content supplied or provided by the trader to the customer or to another person at the customer’s request (such as, for example, information about— prices or other terms on which goods, services or digital content are supplied or provided to the customer or the other person, how they are used by the customer or the other person, or their performance or quality when used by the customer or the other person), and information relating to the provision of information described in paragraph (a), or of other information relating to a customer of a trader, to a person in accordance with data regulations; “data holder”, in relation to customer data or business data of a trader, means— the trader, or a person who, in the course of a business, processes the data Section 1(2)

dashboard service — an electronic communications service by means of which information may be requested by and provided to a person Section 25(1)

data regulations — regulations under section 2 or 4 (and see section 23) Section 1(2)

decision-maker — a person who is authorised or required to take a decision described in section 3(2)(c) (authorisation) or 5(3)(b) (approval) Section 6(2)

designated — designated by regulations made by the Secretary of State that are in force Section 133(5)

digital content — data which is produced and supplied in digital form Section 135(4)

digital content — data which is produced and supplied in digital form; “electronic communications service” has the meaning given by section 32 of the Communications Act 2003; “goods” includes water, gas and electricity (however supplied); “micro business” has the meaning given by section 33 of the Small Business, Enterprise and Employment Act 2015, read with any regulations under that section Section 25(1)

digital verification services — verification services provided to any extent by means of the internet Section 27(2)

direct marketing — the communication (by whatever means) of advertising or marketing material which is directed to particular individuals Schedule 11, paragraph 2(2)

direct marketing — the communication (by whatever means) of advertising or marketing material which is directed to particular individuals Section 110(2)

DVS-registered person — a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”). An order under subsection (3) which specifies a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to specified services (see section 36 of the Data (Use and Access) Act 2025) Section 55(1)

DVS-registered person — a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”). An order prescribing requirements for the purposes of this Chapter which prescribes a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section 36 of the Data (Use and Access) Act 2025) Section 55(2)

DVS-registered person — a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”). Regulations under paragraph 5(6)(b) or (c) which prescribe a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section 36 of the Data (Use and Access) Act 2025) Section 55(3)

enforcement functions — the functions of the Information Commissioner under those provisions, as applied by that Schedule Section 115(5)

enforcement powers — the powers under— Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR, sections 142 to 159 of this Act, paragraph 2(a), (b) and (c) of Schedule 13 to this Act, and Schedules 15 and 16 to this Act; “the law enforcement purposes” has the meaning given in section 31 of this Act Section 102(4)

enforcer — a public authority that is authorised or required to carry out monitoring or enforcement described in subsection (1) Section 8(2)

Film — a moving image. A reference to an “image”, “photograph” or “film” includes data stored by any means which is capable of conversion into an image, photograph or film. An image of a person appears to be an image of an adult if— the impression conveyed by the image is that the person shown is aged 18 or over, or the predominant impression conveyed by the image is that the person shown is aged 18 or over (even if some of the physical characteristics shown are those of a person under 18). The Section 138(2)

financial assistance — any kind of financial assistance whether actual or contingent, including a grant, loan, guarantee or indemnity, but does not include buying a company’s share capital Section 13(5)

financial services provider — a person providing financial services Section 14(10)

financial year — — the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and each successive period of 12 months Schedule 14, paragraph 1(6)

good practice in the processing of personal data — such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation; “trade association” includes a body representing controllers or processors Section 92(2)

INTERPOL — the organisation called the International Criminal Police Organization - INTERPOL Section 128(3)

intra-group transmission — transmission between members of a group of undertakings or between members of a group of institutions affiliated to a central body; “security of network and information systems” has the same meaning as in the Network and Information Systems Regulations 2018 (S.I. 2018/506) (see regulation 1(3)(g)) Section 70(4)

IT service — an information technology service, including any service (whether physical or virtual) which consists of, or is provided in connection with, the development, making available, operation or maintenance of information technology; in the definition of “processing”, omit “and (14)”, and at the end insert— Schedule 15, paragraph 3(6)

justice — — in England and Wales, a justice of the peace, in Scotland, a sheriff or summary sheriff, and in Northern Ireland, a lay magistrate Section 9(9)

key performance indicators — factors by reference to which the Commissioner’s performance can be measured most effectively Section 95(3)

maximum term for summary offences — — if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months; if the offence is committed after that time, 51 weeks. Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66F if the information is laid or the charge is issued— before the end of the period of 3 years beginning with the day on which the offence was committed, and before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge. A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor’s knowledge is conclusive evidence of that fact Section 138(2)

medium-sized business — a business with at least 50 but fewer than 250 staff Section 135(4)

micro business — a business with fewer than 10 staff Section 135(4)

non-Crown IP right — any copyright, database right or other intellectual property right which is not owned by the Crown Section 106C(5)

non-Crown IP right — any copyright, database right or other intellectual property right which is not owned by the Crown. The Secretary of State must produce guidance for persons described in subsection (2) about how to protect information kept in, or obtained from, NUAR. The persons are persons who, pursuant to regulations made under section 106C, are able to access information kept in NUAR. The Secretary of State may revise or replace the guidance. The Secretary of State must publish the guidance (and any revised or replacement guidance) in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons described in subsection (2). The same guidance may discharge the obligations of the Secretary of State under this section and under Article 45D of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)). The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to pay fees to the Secretary of State for or in connection with the exercise by the Secretary of State of any function conferred by or under this Part. The regulations may— specify the amounts of the fees, or the maximum amounts of the… Section 56(1)

non-Crown IP right — any copyright, database right or other intellectual property right which is not owned by the Crown; “processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act). The Secretary of State must produce guidance for persons described in paragraph (2) about how to protect information kept in, or obtained from, NUAR. The persons are persons who, pursuant to regulations made under Article 45C, are able to access information kept in NUAR. The Secretary of State may revise or replace the guidance. The Secretary of State must publish the guidance (and any revised or replacement guidance) in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons described in paragraph (2). The same guidance may discharge the obligations of the Secretary of State under this Article and under section 106D of the New Roads and Street Works Act 1991. The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to pay fees to the Secretary of State for or in connection with the exercise by the Secretary of State of any function conferred by or under a NUAR provision. The… Section 58(3)

NUAR provision — any of Articles 45A to 45I and Schedule 2ZA; in the definition of “prescribed”— for “means” substitute “means— Section 58(2)

overseas authority — a person, or description of person, with functions relating to the regulation or supervision of trust services outside the United Kingdom. Before making regulations under this Article, the Secretary of State must consult the supervisory body. Regulations under this Article may include transitional or transitory provision or savings. Regulations under this Article are to be made by statutory instrument. A statutory instrument containing regulations under this Article is subject to annulment in pursuance of either House of Parliament Section 133(5)

overseas law enforcement authority — a person formed or existing under the law of a country or territory outside the United Kingdom so far as exercising functions which— correspond to those of a police force, or otherwise involve the investigation or prosecution of offences Section 127(6)

Part 4 sensitive processing — processing of personal data that, at the time the regulations are made, is sensitive processing for the purposes of Part 4 of the Data Protection Act 2018 by virtue of regulations made under section 91A of that Act. Regulations under this section may amend section 202 Section 74(12)

personal information — information relating to a person whose identity— is specified in the information, or can be deduced from it; “the Revenue and Customs” has the meaning given by section 17(3) of the Commissioners for Revenue and Customs Act 2005 Section 46(5)

personal information — information relating to a person whose identity— is specified in the information, or can be deduced from it Section 47(7)

personal information — information relating to a person whose identity— is specified in the information, or can be deduced from it Section 48(7)

pre-commencement enactment — an enactment so far as passed or made before the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force. Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1) Section 106(3)

pre-commencement enactment — an enactment so far as passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3) Section 106(5)

pre-commencement standard clauses — standard data protection clauses specified in— regulations made under section 17C of the 2018 Act and in force immediately before the relevant day, or a document issued by the Information Commissioner under section 119A of the 2018 Act before the relevant day and not withdrawn before that day Schedule 9, Part 2, paragraph 29(6)

pre-revision certificate — a certificate which— certifies that digital verification services provided by the holder of the certificate are provided in accordance with the DVS trust framework, and was issued before the time the relevant revision to the DVS trust framework comes into force Section 28(9)

pre-revision certificate — a certificate which— certifies that digital verification services provided by the holder of the certificate are provided in accordance with the supplementary code, and was issued before the time the relevant revision to the supplementary code comes into force Section 29(10)

prescribed — prescribed in or determined under regulations under section 91A(1) Schedule 16, Part 1, paragraph 3(5)

prescribed — prescribed by regulations made by the Secretary of State Section 106J(1)

prescribed — prescribed in FCA interface rules Section 14(10)

prescribed — prescribed by regulations made by the Secretary of State. Regulations under this Part may make— different provision for different purposes; supplementary and incidental provision. Regulations under this Part are to be made by statutory instrument. Before making regulations under this Part the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision which would be within the legislative competence of Senedd Cymru if contained in an Act of the Senedd (ignoring any requirement for the consent of a Minister of the Crown imposed under Schedule 7B to the Government of Wales Act 2006). Where regulations under this Part are subject to “the affirmative procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before and approved by a resolution of each House of Parliament. Where regulations under this Part are subject to “the negative procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament. Any provision that may be made in regulations under this Part subject to the negative procedure may be made in… Section 56(1)

prescribed — — in subsections (1) to (2)— in relation to apparatus in streets in England, prescribed by regulations made by the Secretary of State; in relation to apparatus in streets in Wales, prescribed by regulations made by the Secretary of State or the Welsh Ministers; otherwise, prescribed by regulations made by the Secretary of State. Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales. For the meaning of “NUAR”, see section 106A Section 57(3)

prescribed — — in paragraphs (1) to (2), prescribed by regulations made by the Secretary of State or the Department for Infrastructure; otherwise, prescribed by regulations made by the Secretary of State. For the meaning of “NUAR”, see Article 45A Section 59(3)

primary legislation — — an Act of Parliament; an Act of the Scottish Parliament; a Measure or Act of Senedd Cymru; Northern Ireland legislation Section 139(7)

primary legislation — — an Act of Parliament; an Act of the Scottish Parliament; a Measure or Act of Senedd Cymru; Northern Ireland legislation; “processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act) and related terms are to be interpreted accordingly Section 25(1)

protected condition in Schedule 10 — a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3). Regulations under this section may amend this Part and sections 205 and 206. Regulations under this section are subject to the affirmative resolution procedure Section 74(8)

protected condition in Schedule 8 — a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6). Regulations under this section may amend this Part and sections 205 and 206. Regulations under this section are subject to the affirmative resolution procedure Section 74(5)

public authority — a person whose functions— are of a public nature, or include functions of that nature; “small business” has the meaning given by section 33 of the Small Business, Enterprise and Employment Act 2015, read with any regulations under that section Section 25(1)

public authority — a person whose functions— are of a public nature, or include functions of that nature Section 45(8)

public authority — a person whose functions— are of a public nature, or include functions of that nature Section 49(11)

public body — a body or other person whose functions are, or include, functions of a public nature, and a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1). A code of conduct described in subsection (1) may, for example, make provision with regard to— lawful and fair processing; the collection of personal data; the information provided to the public and to data subjects; the exercise of the rights of data subjects; the measures and procedures referred to in sections 56, 57 and 62; the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects; the transfer of personal data to third countries or international organisations; out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing. The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft. Where an expert public body does so, the Commissioner must— provide the body with an opinion on whether the… Section 84(6)

qualifying competent authority — a competent authority specified or described in regulations made by the Secretary of State. after subsection (3) insert— Regulations under this section are subject to the affirmative resolution procedure Section 89(2)

qualifying-equivalent offence — an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a qualifying offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted) Section 126(10)

recordable-equivalent offence — an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a recordable offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted) Section 126(4)

register — a register of births or register of deaths kept under that Act, at the end insert— “the relevant registrar” for a register means— in the case of a register in hard copy form (within the meaning of the Births and Deaths Registration Act 1953), the superintendent registrar having custody of the register; in the case of a register not in hard copy form (within the meaning of that Act)— the registrar of births and deaths for the sub-district for which the register is or has been kept, or the superintendent registrar for the district containing that sub-district Schedule 3, Part 2, paragraph 23(4)

relevant enactment — an enactment so far as passed or made on or after the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force; “requirement” includes a prohibition or restriction. The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)— and the references in subsection (3) to a duty or power are to be read accordingly. by authorising one person to require another person to process personal data, or by removing restrictions on processing personal data Section 106(2)

relevant financial services action — action described in section 2(4) taken in relation to services or digital content provided or supplied by a financial services provider Section 14(10)

relevant function — a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 106E) other than— a power to make regulations, or a function under section 106E(4) (specifying of fees etc) Section 106H(8)

relevant function — a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 39) other than a power to make regulations Section 52(4)

relevant function — a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 106E) other than— a power to make regulations, or a function under section 106E(4) (specifying of fees etc). If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise. A duty or power to process information that is imposed or conferred by or under this Part does not operate to require or authorise the processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, that duty or power is to be taken into account). In this section— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act); “personal data” has the same meaning as in that Act (see section 3(2) of that Act). In this Part Section 56(1)

relevant function — a function of the Secretary of State conferred by or under a NUAR provision (including the function of charging or recovering fees under regulations under Article 45E) other than— a power to make regulations, or a function under Article 45E(4) (specifying of fees etc). If a person exercises the function of charging or recovering fees by virtue of arrangements under this Article, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise. A duty or power to process information that is imposed or conferred by or under a NUAR provision does not operate to require or authorise the processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, that duty or power is to be taken into account). In this Article— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act); “personal data” has the same meaning as in that Act (see section 3(2) of that Act); “processing” has the same meaning as in that Act (see section 3(4) of that Act) Section 58(3)

relevant individual — — in the case of a notice to an individual, that individual; in the case of a notice to a body corporate (other than a partnership), an officer of that body; in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business; in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body. For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is— in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address; in any other case, the address determined in accordance with subsection (5). The address is— in a case where the person is a body corporate with a registered office in the United Kingdom, that office; in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office; in any other case, an… Section 96(3)

relevant IT provider — a person involved in marketing, supplying, providing or otherwise making available— whether for payment or free of charge, but only so far as the technology or service is used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care. information technology, an IT service, or a service which consists of processing information using information technology Schedule 15, paragraph 3(6)

relevant licence — a licence for the purposes of section 5 of the Gas Act 1986 or section 4 of the Electricity Act 1989 (prohibitions on unlicensed activities) Schedule 16, Part 1, paragraph 3(7)

relevant NHS body — — an NHS trust or NHS foundation trust in England, an NHS trust or Local Health Board in Wales, a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978, the Common Services Agency for the Scottish Health Service, or any of the health and social care bodies in Northern Ireland falling within paragraphs (b) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)). The Secretary of State may by regulations make further provision about when the requirement for appropriate safeguards under Article 84B(2) is, or is not, satisfied. Regulations under this Article may not amend or revoke Article 84C(2), (3) or (4) (but may change the meaning of “approved medical research” for the purposes of Article 84C). Regulations under this Article are subject to the affirmative resolution procedure Section 86(2)

relevant person — a public body or another person exercising functions of a public nature Schedule 7, paragraph 6(6)

representative body — an association or other body representing categories of— communications providers, or other persons engaged in activities regulated by these Regulations; “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018. The Commissioner may, in accordance with this regulation, accredit a body for the purpose of monitoring whether persons other than public bodies comply with a code of conduct described in regulation 32A(1). The Commissioner may accredit a body only where the Commissioner is satisfied that the body has— demonstrated its independence, demonstrated that it has an appropriate level of expertise in relation to the subject matter of the code, established procedures which allow it— to assess a person’s eligibility to apply the code, to monitor compliance with the code, and to review the operation of the code periodically, established procedures and structures to handle complaints about infringements of the code or about the manner in which the code has been, or is being, implemented by a person, made arrangements to publish information about the procedures and structures described in sub-paragraph (d), and demonstrated that it does not have a conflict… Section 116(2)

section 2(4) actor — — a person who, in reliance on regulations under subsection (4) of section 2, takes action described in that subsection; a data holder or other person who facilitates or does other things in connection with such action Section 14(10)

sensitive personal data — personal data whose retention, or (as appropriate) retention and examination, would be sensitive processing Section 74(11)

sensitive processing — — processing of personal data relating to a living individual that is processing of a kind described in section 86(7)(a) to (e) of the Data Protection Act 2018, or processing of personal data relating to a deceased individual that would be that kind of processing if the personal data related to a living individual Section 74(11)

small business — a business with at least 10 but fewer than 50 staff; “use” an AI system means instruct an AI system to generate outputs or to influence an environment (and related terms are to be interpreted accordingly) Section 135(4)

smart meter communication licence — a licence under section 7AB of the Gas Act 1986 or a licence under section 6(1)(f) of the Electricity Act 1989 Schedule 16, Part 1, paragraph 3(5)

specified — specified in the modification Schedule 16, Part 1, paragraph 3(7)

specified — specified by regulations under this Article Section 132(2)

specified — specified, or of a description specified, by regulations under this Part, or in exercise of a power conferred by such regulations, except to the extent otherwise provided in this Part Section 25(1)

specified — specified in regulations under this section Section 63(2)

tender exercise — the procedure set out in regulations made in reliance on section 91A(2)(a) for determining to whom a particular smart meter communication licence is to be granted Schedule 16, Part 1, paragraph 3(5)

the 2018 Act — the Data Protection Act 2018 Section 66

The 40-day period — — the period of 40 days beginning with the day on which the draft is laid before Parliament, or if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament Section 49(9)

the Accreditation Regulation — Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93; “conformity assessment body” has the same meaning as in the Accreditation Regulation (see Article 2(13) of that Regulation) Section 33(7)

the applicable time period — the period of one month beginning with the relevant time, subject to paragraph 3 Section 76(3)

the applicable time period — the period of one month beginning with the relevant time, subject to subsection (14A); after subsection (14) insert— The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of— the complexity of requests made by the data subject, or the number of such requests. A notice under subsection (14A) must— be given before the end of the period of one month beginning with the relevant time, and state the reasons for the delay Section 76(7)

The appropriate Registrar General — — in relation to a UK birth register entry of which a certified copy is kept by a Registrar General or which is in a register so kept, whichever Registrar General keeps that certified copy or that register; in relation to a UK birth register entry in a register kept under section 1 of the Births and Deaths Registration Act 1953, the Registrar General for England and Wales. For the purposes of this section each of the following is a Registrar General— the Registrar General for England and Wales; the Registrar General for Scotland; the Registrar General for Northern Ireland Schedule 3, Part 2, paragraph 26(3)

the Authority — the Gas and Electricity Markets Authority Schedule 16, Part 1, paragraph 3(5)

the commencement day — the day on which this Act is passed; “law enforcement authority” has the meaning given by section 18E(1) of the Counter-Terrorism Act 2008; “section 18 material” has the meaning given by section 18(2) of that Act Section 126(14)

The Commission — the Information Commission (see section 114A) Section 117(3)

the Copyright and AI Consultation Paper — the command paper “Copyright and AI: Consultation”, numbered CP1205, published on 17 December 2024; “copyright owner” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988; “develop” an AI system means carry on an activity involved in producing the system, such as (for example) designing, programming, training or testing the system (and related terms are to be interpreted accordingly) Section 135(4)

the eIDAS Regulation — Regulation (EU) No. 910/2014 of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market Section 129

the Implementing Decision — Commission Implementing Decision (EU) 2015/1506 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies pursuant to Articles 27(5) and 37(5) of the eIDAS Regulation Section 131(7)

the Implementing Decision — Commission Implementing Decision (EU) 2015/1506 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies; “overseas”, in relation to an electronic signature or electronic seal, means provided by a person established in a country or territory outside the United Kingdom Section 132(2)

the main data protection legislation — the data protection legislation other than provision of or made under— Chapter 6 or 8 of the UK GDPR, or Parts 5 to 7 of this Act Section 106(2)

the National Central Bureau — the body appointed for the time being in accordance with INTERPOL’s constitution to serve as the United Kingdom’s National Central Bureau. The reference in subsection (1) to material obtained or acquired as part of a request or notification includes material obtained or acquired as part of a communication, sent to the United Kingdom via INTERPOL’s systems, correcting, updating or otherwise supplementing the request or notification. The Secretary of State may by regulations amend section 18AA to make such changes as the Secretary of State considers appropriate in consequence of— changes to the name of the organisation which, when section 18AA was enacted, was called the International Criminal Police Organization - INTERPOL (“the organisation”), changes to arrangements made by the organisation which involve fingerprints or DNA profiles being provided to members of the organisation (whether changes to existing arrangements or changes putting in place new arrangements), or changes to the organisation’s arrangements for liaison between the organisation and its members or between its members. Regulations under this section are subject to affirmative resolution procedure Section 128(3)

the PEC Regulations — these Regulations Schedule 13, paragraph 30

the PEC Regulations — the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) Section 109

the Periods of Time Regulation — Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits Schedule 11, paragraph 3(2)

the Periods of Time Regulation — Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits Section 110(5)

the relevant day — the day on which paragraph 4 of Schedule 7 to this Act comes into force Schedule 9, Part 2, paragraph 26(2)

the relevant day — the day on which paragraph 6 of Schedule 7 to this Act comes into force; “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act) Schedule 9, Part 2, paragraph 27(3)

the relevant day — the day on which paragraph 8 of Schedule 7 to this Act comes into force Schedule 9, Part 2, paragraph 28(2)

the relevant day — the day on which paragraph 6 of Schedule 7 to this Act comes into force Schedule 9, Part 2, paragraph 29(6)

the relevant day — the day on which paragraph 9(5) of Schedule 7 to this Act comes into force Schedule 9, Part 2, paragraph 30(2)

the relevant day — the day on which paragraph 10 of Schedule 7 to this Act comes into force Schedule 9, Part 2, paragraph 31(2)

the relevant day — the day on which paragraph 4 of Schedule 8 to this Act comes into force Schedule 9, Part 2, paragraph 32(2)

the relevant day — the day on which paragraph 6 of Schedule 8 to this Act comes into force; “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act) Schedule 9, Part 2, paragraph 33(4)

the relevant person — — in relation to Part 1 provision made by the Secretary of State, the Secretary of State, and in relation to Part 1 provision made by the Treasury, the Treasury Section 19(2)

The relevant time — the latest of the following— when the controller receives the request in question; when the controller receives the information (if any) requested in connection with a request under Article 12(6); when the fee (if any) charged in connection with the request under Article 12(5) is paid. The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of— the complexity of requests made by the data subject, or the number of such requests. A notice under paragraph 3 must— be given before the end of the period of one month beginning with the relevant time, and state the reasons for the delay. Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates— the controller may ask the data subject to provide the further information, and the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards— the applicable time period, or the period described in paragraph 4(a). An example of a case in… Section 76(3)

the reporting period — the period to which the report relates Section 102(4)

the reporting period — the period to which the report relates Section 91(4)

the UK GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data Section 66

the UK national accreditation body — the UK national accreditation body for the purposes of Article 4(1) of the Accreditation Regulation Section 33(7)

third party recipient — — in section 3, a third party in relation to customer data (see section 2(2)), in sections 4 and 5, a third party recipient in relation to business data (see section 4(2)), and in other sections, a third party recipient in relation to customer data or business data (see sections 2(2) and 4(2)) Section 25(1)

third party recipient — a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)) Section 2(2)

third party recipient — a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)) Section 4(2)

trader — a person who supplies or provides goods, services or digital content in the course of a business, whether acting personally or through another person acting in the trader’s name or on the trader’s behalf Section 1(2)

tribunal — any tribunal in which legal proceedings may be brought Schedule 11, paragraph 2(3)

trust product — an electronic signature, an electronic seal, an electronic time stamp or an electronic registered delivery service. The Secretary of State may not make regulations under this Article specifying a description of overseas trust product unless satisfied that the reliability of such a product is at least equivalent to the reliability of a comparable trust product that is qualified. When making regulations under this Article in relation to a description of overseas trust product, the Secretary of State must have regard to (among other things) the law in the other country or territory relevant to that description of product and related trust services. The Secretary of State may by regulations provide that an overseas electronic signature of a specified description is to be treated— for the purposes of Article 27(1), as an advanced electronic signature that complies with the Implementing Decision; for the purposes of Article 27(2), as an advanced electronic signature based on a qualified certificate for electronic signature, or a qualified signature, that complies with the Implementing Decision. The Secretary of State may by regulations provide that an overseas electronic seal of a… Section 132(2)

UK GDPR investigation — an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR) Section 102(4)

undertaking — — any person, other than a public authority, carrying on a trade or business, whether or not with a view to profit, or any body, or the trustees of a trust, established for charitable purposes only. In this section, in so far as it forms part of the law of Scotland or Northern Ireland, “charitable purpose” has the same meaning as it has in the law of England and Wales (see section 2 of the Charities Act 2011) Section 123(4)

verification services — services that are provided at the request of an individual and consist in— ascertaining or verifying a fact about the individual from information provided otherwise than by the individual, and confirming to another person that the fact about the individual has been ascertained or verified from information so provided Section 27(3)

web crawler — a computer program that obtains data from websites in accordance with instructions and that can autonomously determine which websites to visit Section 136(8)