Section 189(4)

Where subsection (1) applies to a disclosure of information made by A to B, the protections set out in subsection (5) apply in relation to a further disclosure of that information made by B to another person (“C”) if— C is carrying on business in circumstances where subsection (3) applies, and to the extent that the information is personal data, the UK GDPR applies to all processing of the information by B, up to and including the disclosure of the information to C.

← 3 · All articles · 5 →

Source: legislation.gov.uk · retrieved 2026-09-04