Section 77

In Article 13 of the UK GDPR (information to be provided where personal data is collected from the data subject)— in paragraph 4, for “shall not apply where and insofar as” substitute “do not apply to the extent that”, and at the end insert— Paragraph 3 does not apply to the extent that— the controller intends to further process the personal data— for (and only for) the purposes of scientific or historical research, the purposes of archiving in the public interest or statistical purposes, and in accordance with Article 84B, and providing the information is impossible or would involve a disproportionate effort. For the purposes of paragraph 5(b), whether providing the information would involve a disproportionate effort depends on, among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing. A controller relying on paragraph 5 must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information available publicly. In Article 14 of the UK GDPR (information to be provided where personal data is not obtained from the data subject)— in paragraph 5— for “shall not apply where and insofar as” substitute “do not apply to the extent that”, omit point (b), omit the “or” at the end of point (c), in point (d), omit “where”, and after that point insert— providing the information is impossible or would involve a disproportionate effort, or the obligation referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of the processing for which the personal data are intended. at the end insert— For the purposes of paragraph 5(e), whether providing the information would involve a disproportionate effort depends on, among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing. A controller relying on paragraph 5(e) or (f) must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information available publicly.

← 7 · All articles · 1 →

Source: legislation.gov.uk · retrieved 2026-09-04