Section 77(1)

In Article 13 of the UK GDPR (information to be provided where personal data is collected from the data subject)— in paragraph 4, for “shall not apply where and insofar as” substitute “do not apply to the extent that”, and at the end insert— Paragraph 3 does not apply to the extent that— the controller intends to further process the personal data— for (and only for) the purposes of scientific or historical research, the purposes of archiving in the public interest or statistical purposes, and in accordance with Article 84B, and providing the information is impossible or would involve a disproportionate effort. For the purposes of paragraph 5(b), whether providing the information would involve a disproportionate effort depends on, among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing. A controller relying on paragraph 5 must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information available publicly.

← 77 · All articles · 2 →

Source: legislation.gov.uk · retrieved 2026-09-04