lexiara

DPA 2018 — Data Protection Act 2018

law · United Kingdom · ukpga/2018/12

3724 provisions

Defined terms · All instruments

1 Overview
1
2
3
4
5
6
7
8
2 Protection of personal data
1
2
3 Terms relating to the processing of personal data
1
2
3
4
5
6
7
8
8A
9
10
10A
11
12
13
14
15
4 Processing to which this Part applies
1
2
3
5 Definitions
1
2
3
4
5
6
7
8
6 Meaning of “controller”
1
2
7 Meaning of “public authority” and “public body”
1
2
3
4
5
8 Lawfulness of processing: public interest etc
9 Child's consent in relation to information society services
9A Processing in reliance on relevant international law
1
2
3
4
5
6
10 Special categories of personal data and criminal convictions etc data
1
2
3
4
5
6
7
11 Special categories of personal data etc: supplementary
1
2
12 Limits on fees that may be charged by controllers
1
2
3
13 Obligations of credit reference agencies
1
2
3
13A Meaning of “relevant offence” for purpose of right to erasure
1
2
14 Automated decision-making authorised by law: safeguards
15 Exemptions etc
1
2
3
4
4A
5
16 Power to make further exemptions etc by regulations
1
2
3
17 Accreditation of certification providers
1
2
3
4
5
6
7
8
17A Transfers based on adequacy regulations
17B Transfers based on adequacy regulations: review etc
17C Standard data protection clauses
18 Transfers of personal data to third countries etc : public interest
19 Processing for archiving, research and statistical purposes: safeguards
20 Meaning of “court”
21 Definitions
1
2
3
4
5
6
7
8
22 Application of the GDPR to processing to which this Chapter applies
23 Power to make provision in consequence of regulations related to the GDPR
24 Manual unstructured data held by FOI public authorities
1
2
3
4
5
6
7
8
9
25 Manual unstructured data used in longstanding historical research
1
2
3
26 National security and defence exemption
1
2
27 National security: certificate
1
2
3
4
5
6
7
8
9
10
28 National security and defence: modifications to Articles 9 and 32 of the UK GDPR
1
2
3
4
5
29 Processing to which this Part applies
1
1A
2
3
30 Meaning of “competent authority”
1
2
3
4
5
6
7
31 “The law enforcement purposes”
32 Meaning of “controller” and “processor”
1
2
3
33 Other definitions
1
2
3
4
5
6
6A
7
8
34 Overview and general duty of controller
1
2
3
35 The first data protection principle
1
2
3
4
5
6
7
8
36 The second data protection principle
1
2
3
4
37 The third data protection principle
38 The fourth data protection principle
1
2
3
4
5
39 The fifth data protection principle
1
2
40 The sixth data protection principle
41 Safeguards: archiving
1
2
42 Safeguards: sensitive processing
1
2
3
4
5
42A Further provision about sensitive processing
1
2
3
4
43 Overview and scope
1
2
3
4
5
44 ... Controller's general duties
1
2
3
4
5
6
7
45 Right of access by the data subject
1
2
2A
3
4
5
6
7
45A Exemption from sections 44 and 45: legal professional privilege
1
2
3
4
5
46 Right to rectification
1
2
3
4
47 Right to erasure or restriction of processing
1
2
3
4
48 Rights under section 46 or 47: supplementary
1
2
3
4
5
6
7
8
9
10
49 Right not to be subject to automated decision-making
50 Automated decision-making authorised by law: safeguards
50A Automated processing and significant decisions
1
2
50B Restrictions on automated decision-making based on sensitive processing
1
2
3
50C Safeguards for automated decision-making
1
2
3
4
5
50D Further provision about automated decision-making
1
2
3
4
5
51 Exercise of rights through the Commissioner
1
2
3
4
5
6
52 Form of provision of information etc
1
2
3
4
5
6
53 Manifestly unfounded or excessive requests by the data subject
1
2
3
4
4A
5
6
7
54 Meaning of “applicable time period”
1
2
3
3A
3B
3C
3D
4
5
6
55 Overview and scope
1
2
3
56 General obligations of the controller
1
2
3
4
57 Data protection by design and default
1
2
3
4
5
58 Joint controllers
1
2
3
59 Processors
1
2
3
4
5
6
7
7A
8
60 Processing under the authority of the controller or processor
61 Records of processing activities
1
2
3
4
5
62 Logging
1
2
3
4
5
63 Co-operation with the Commissioner
64 Data protection impact assessment
1
2
3
4
65 Prior consultation with the Commissioner
1
2
3
4
5
6
7
66 Security of processing
1
2
3
67 Notification of a personal data breach to the Commissioner
1
2
3
4
5
6
7
8
9
68 Communication of a personal data breach to the data subject
1
2
3
4
5
6
7
8
9
69 Designation of a data protection officer
1
2
3
4
70 Position of data protection officer
1
2
3
4
5
71 Tasks of data protection officer
1
2
3
71A Codes of conduct
1
2
3
4
5
6
7
72 Overview and interpretation
1
2
73 General principles for transfers of personal data
A1
1
2
3
4
5
6
7
74 Transfers on the basis of an adequacy decision
74A Transfers based on adequacy regulations
74AA Transfers approved by regulations
1
2
3
4
5
74AB The data protection test
1
2
3
4
74B Transfers approved by regulations: monitoring
1
2
3
4
5
6
7
75 Transfers subject to appropriate safeguards
1
1A
2
3
4
5
6
7
8
76 Transfers based on special circumstances
A1
1
2
2A
3
4
77 Additional conditions for transfers in reliance on section 73(4)(b)
1
2
3
4
5
6
7
8
78 Subsequent transfers
A1
1
1A
2
3
4
5
6
7
78A National security exemption
1
2
3
4
79 National security: certificate
1
2
3
3A
4
5
6
7
8
9
10
11
12
13
80 Special processing restrictions
1
2
3
4
5
6
7
81 Reporting of infringements
1
2
3
4
5
6
82 Processing to which this Part applies
A1
1
2
2A
3
4
82A Designation of processing by a qualifying competent authority
1
2
3
4
5
6
7
8
9
82B Duration of designation notice
1
2
3
82C Review and withdrawal of designation notice
1
2
3
4
5
6
7
82D Records of designation notices
1
2
3
4
5
82E Appeal against designation notice
1
2
83 Meaning of “controller” and “processor”
A1
1
2
3
84 Other definitions
1
2
2A
3
4
5
6
6A
6B
7
85 Overview
1
2
86 The first data protection principle
1
2
3
4
5
6
7
87 The second data protection principle
1
2
3
4
88 The third data protection principle
89 The fourth data protection principle
90 The fifth data protection principle
91 The sixth data protection principle
1
2
91A Further provision about sensitive processing
1
2
3
4
92 Overview
1
2
93 Right to information
1
2
3
4
94 Right of access
1
2
2A
3
4
5
6
7
8
9
10
11
12
13
14
14A
14B
15
95 Right of access: supplementary
1
2
3
4
5
96 Right not to be subject to automated decision-making
1
2
3
4
97 Right to intervene in automated decision-making
1
2
3
4
5
6
98 Right to information about decision-making
1
2
99 Right to object to processing
1
2
3
4
5
6
7
8
100 Rights to rectification and erasure
1
2
3
4
5
6
101 Overview
102 General obligations of the controller
103 Data protection by design
1
2
104 Joint controllers
1
2
3
105 Processors
1
2
3
106 Processing under the authority of the controller or processor
107 Security of processing
1
2
108 Communication of a personal data breach
1
2
3
4
5
6
7
109 Transfers of personal data outside the United Kingdom
1
2
110 National security
1
2
111 National security: certificate
1
2
3
4
5
6
7
8
9
10
112 Other exemptions
113 Power to make further exemptions
1
2
114 The Information Commissioner
1
2
114A The Information Commission
1
2
115 General functions under the UK GDPR and safeguards
1
2
3
4
5
6
7
8
9
10
116 Other general functions
A1
1
2
3
117 Competence in relation to courts etc
118 Co-operation between parties to the Data Protection Convention
1
2
3
4
5
119 Inspection of personal data in accordance with international obligations
1
2
3
4
5
6
7
119A Standard clauses for transfers to third countries etc
1
2
3
4
5
6
7
8
9
10
11
12
120 Further international role
1
2
2A
3
4
5
6
7
120A Principal objective
120B Duties in relation to functions under the data protection legislation
120C Strategy
1
2
3
120D Duty to consult other regulators
1
2
3
121 Data-sharing code
1
2
3
4
5
122 Direct marketing code
1
2
3
4
5
123 Age-appropriate design code
1
2
3
4
5
6
7
124 Data protection and journalism code
1
2
3
4
5
124A Other codes of practice
1
2
3
4
5
6
7
124B Panels to consider codes of practice
1
2
3
4
5
6
7
8
9
10
11
12
124C Impact assessments for codes of practice
1
2
125 Approval of codes prepared under sections 121 to 124A
1
2
3
4
5
6
7
8
9
126 Publication and review of codes issued under section 125(4)
1
2
3
4
127 Effect of codes issued under section 125(4)
1
2
3
4
5
128 Other codes of practice
129 Consensual audits
1
2
3
130 Records of national security certificates
1
2
3
4
5
6
131 Disclosure of information to the Commissioner
1
2
3
132 Confidentiality of information
1
2
3
133 Guidance about privileged communications
1
2
3
4
5
6
134 Fees for services
135 Manifestly unfounded or excessive requests by data subjects etc
A1
1
1A
2
3
4
5
136 Guidance about fees
1
2
137 Charges payable to the Commissioner by controllers
1
2
3
4
5
6
7
8
138 Regulations under section 137: supplementary
1
2
3
4
5
6
7
139 Reporting to Parliament
1
1A
1B
2
2A
3
139A Analysis of performance
1
2
3
140 Publication by the Commissioner
141 Notices from the Commissioner
1
2
3
4
5
6
7
142 Information notices
1
2
3
4
5
6
7
8
9
10
143 Information notices: restrictions
1
2
3
4
5
6
7
8
9
144 False statements made in response to information notices
145 Information orders
1
2
3
146 Assessment notices
1
2
3
3A
4
5
6
7
8
9
10
11
11A
12
146A Assessment notices: approval of person to prepare report etc
1
2
3
4
5
6
147 Assessment notices: restrictions
1
2
3
4
5
6
148 Destroying or falsifying information and documents etc
1
2
3
148A Interview notices
1
2
3
4
5
6
7
8
9
148B Interview notices: restrictions
1
2
3
4
5
6
7
8
9
148C False statements made in response to interview notices
149 Enforcement notices
1
2
3
4
5
5A
6
7
8
9
150 Enforcement notices: supplementary
1
2
3
4
5
6
7
8
9
151 Enforcement notices: rectification and erasure of personal data etc
1
2
3
4
5
6
7
8
152 Enforcement notices: restrictions
1
2
3
4
153 Enforcement notices: cancellation and variation
1
2
3
154 Powers of entry and inspection
155 Penalty notices
1
2
3
4
5
6
7
8
156 Penalty notices: restrictions
1
2
3
4
5
157 Maximum amount of penalty
1
2
3
4
4A
5
6
7
158 Fixed penalties for non-compliance with charges regulations
1
2
3
4
5
6
159 Amount of penalties: supplementary
1
2
3
160 Guidance about regulatory action
1
2
3
4
5
5A
6
7
8
9
10
11
12
161 Approval of first guidance about regulatory action
1
2
3
4
5
6
161A Annual report on regulatory action
1
2
3
4
5
6
162 Rights of appeal
1
2
3
4
163 Determination of appeals
1
2
3
4
5
6
164 Applications in respect of urgent notices
1
2
3
4
5
164A Complaints by data subjects to controllers
1
2
3
4
5
164B Controllers to notify the Commissioner of the number of complaints
1
2
3
4
5
165 Complaints by data subjects to the Commissioner
1
2
3
4
5
6
7
166 Orders to progress complaints to the Commissioner
1
2
3
4
167 Compliance orders
1
2
3
4
5
168 Compensation for contravention of the UK GDPR
1
2
3
169 Compensation for contravention of other data protection legislation
1
2
3
4
5
170 Unlawful obtaining etc of personal data
1
2
3
4
5
6
7
171 Re-identification of de-identified personal data
1
2
3
4
5
6
7
8
172 Re-identification: effectiveness testing conditions
1
2
3
4
173 Alteration etc of personal data to prevent disclosure to data subject
1
2
3
4
5
174 The special purposes
1
2
3
4
5
6
175 Provision of assistance in special purposes proceedings
1
2
3
4
5
6
7
8
176 Staying special purposes proceedings
1
2
3
177 Guidance about how to seek redress against media organisations
1
2
3
4
5
6
7
178 Review of processing of personal data for the purposes of journalism
1
2
3
4
5
6
7
179 Effectiveness of the media's dispute resolution procedures
1
2
3
180 Jurisdiction
1
2
3
4
5
180A Procedure in connection with subject access requests
1
2
3
4
181 Interpretation of Part 6
182 Regulations and consultation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
183 Power to reflect changes to the Data Protection Convention
1
2
2A
3
4
183A Protection of prohibitions and restrictions etc on processing: relevant enactments
1
2
3
4
5
183B Protection of prohibitions and restrictions etc on processing: other enactments
1
2
3
4
5
6
184 Prohibition of requirement to produce relevant records
1
2
3
4
5
6
185 Avoidance of certain contractual terms relating to health records
1
2
3
4
186 Protection of data subject’s rights
1
2
2A
3
186A Protection of data subject’s rights: further provision
1
2
3
4
5
187 Representation of data subjects with their authority
1
2
3
4
5
188 Representation of data subjects with their authority: collective proceedings
1
2
3
4
5
189 Duty to review provision for representation of data subjects
1
2
3
4
5
6
190 Post-review powers to make provision about representation of data subjects
1
2
3
4
5
191 Framework for Data Processing by Government
1
2
3
4
5
6
7
192 Approval of the Framework
1
2
3
4
5
6
7
193 Publication and review of the Framework
1
2
3
4
194 Effect of the Framework
1
2
3
4
5
195 Reserve forces: data-sharing by HMRC
1
2
196 Penalties for offences
1
2
3
4
5
197 Prosecution
1
2
3
4
5
6
7
198 Liability of directors etc
1
2
3
4
5
199 Recordable offences
1
2
200 Guidance about PACE codes of practice
1
2
3
4
201 Disclosure of information to the Tribunal
1
2
3
202 Proceedings in the First-tier Tribunal: contempt
1
2
3
4
203 Tribunal Procedure Rules
1
2
204 Meaning of “health professional” and “social work professional”
1
2
3
4
205 General interpretation
1
1A
2
3
4
5
206 Index of defined expressions
207 Territorial application of this Act
1
1A
2
3
4
5
6
7
208 Children in Scotland
1
2
3
209 Application to the Crown
1
2
3
4
5
6
7
210 Application to Parliament
1
2
3
4
5
6
211 Minor and consequential provision
1
2
3
4
5
6
7
212 Commencement
1
2
3
4
213 Transitional provision
1
2
3
4
214 Extent
1
2
3
4
5
6
215 Short title
1
1
2
3
2
1
2
3
3
4
5
1
2
6
1
2
7
8
1
2
3
4
5
9
1
2
3
4
5
6
7
10
1
2
3
11
1
2
12
1
2
13
1
2
3
4
14
1
2
15
16
1
2
3
4
5
6
17
1
2
18
1
2
3
4
19
1
2
3
20
1
2
3
4
5
6
7
21
1
2
3
4
22
1
2
3
4
23
1
2
3
4
5
24
1
2
3
25
1
2
3
26
27
1
2
3
28
1
2
29
30
31
32
33
34
35
1
2
3
4
36
37
38
39
40
1
2
41
1
2
1
2
3
3
1
2
3
4
1
1A
1B
1C
2
3
4
4A
1
2
3
4
5
4B
1
2
5
1
2
3
6
7
8
1
2
9
1
2
10
1
2
11
12
13
14
1
2
3
15
1
2
3
4
16
1
2
3
4
17
1
2
3
4
5
18
19
20
1
2
3
21
1
2
3
4
5
22
23
24
25
1
2
3
4
5
26
1
2
3
4
5
6
7
8
9
27
1
2
3
4
28
1
2
3
4
1
2
1
2
3
1
2
4
1
2
3
5
1
2
3
4
6
1
2
3
4
7
1
2
3
4
8
1
2
9
1
2
10
1
2
3
11
12
1
2
3
4
13
14
1
2
3
4
5
15
1
2
3
4
16
1
2
3
4
5
17
1
2
18
1
2
19
20
1
2
3
21
1
2
3
4
5
1
2
3
1
2
3
4
4
1
2
5
1
2
3
4
6
1
1
2
2
1
2
3
4
5
3
1
2
3
4
5
4
1
2
3
4
5
6
7
8
9
5
1
2
3
6
1
2
3
4
7
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
15A
16
17
18
18A
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
1
2
3
4
1
2
3
4
5
6
7
8
1
2
9
1
2
3
4
5
6
1
2
3
1
2
3
4
1
2
3
4
5
6
7
8
1
2
9
1
2
1
2
3
1
2
3
4
5
6
7
8
9
10
11
12
1
2
3
4
5
13
1
2
14
1
2
1
1
2
2
1
2
3
4
3
1
2
3
4
1
2
3
4
5
6
7
5
1
2
3
4
5
6
6
1
2
3
7
8
9
10
1
2
3
11
1
2
3
4
5
12
1 Status
1
2
2 Number of members
1
2
3
4
3 Membership: general
1
2
3
4
5
6
7
8
4 Membership: non-executive members to outnumber executive members
5 Membership: selection on merit etc
1
2
6 Membership: conflicts of interests
1
2
3
4
5
7 Tenure of the chair
1
2
3
4
5
6
7
8 Tenure of deputy chair
1
2
3
9 Tenure of the other non-executive members
1
2
3
4
5
6
7
8
9
10 Remuneration and pensions of non-executive members
1
2
3
11 Executive members: terms and conditions
1
2
3
12 Other staff: appointment, terms and conditions
1
2
3
4
13 Committees
1
2
3
4
14 Delegation of functions
1
2
3
4
5
6
15 Advice from committees
16 Proceedings
1
2
3
4
5
17 Records of proceedings
18 Disqualification for acting in relation to certain matters
1
2
3
4
5
6
7
8
9
19 Validity of proceedings
1
2
20 Money
21 Fees etc and other sums
1
2
3
22 Accounts
1
2
3
4
5
6
23 Authentication of seal and presumption of authenticity of documents
1
2
3
24 Supplementary powers
25 Transitional provision: interim chief executive
1
2
3
4
5
6
7
26 Interpretation
1
1
2
2
3
1
2
3
4
5
6
1
2
7
1
2
8
1
2
3
9
10
1
1
2
2
1
2
3
4
1
2
3
4
5
5
1
2
3
4
5
6
7
8
9
1
2
10
1
2
3
4
11
1
2
3
4
5
12
13
1
2
14
1
2
15
1
2
16
1
2
17
18
19
1
2
1
2
3
3
1
2
3
4
5
4
A1
A2
1
2
5
1
2
6
1
2
7
1
2
3
4
8
1
2
9
1
2
3
4
1
2
1
2
3
1
2
3
3A
1
2
3
4
1
1
2
2
3
1
2
3
4
1
2
3
4
5
6
7
8
5
6
7
1
2
1
1
2
3
2
1
2
3
3
4
5
6
7
8
9
10
11
12
13
4
14
15
1
2
3
16
1
2
3
17
1
2
3
4
18
1
2
3
4
19
20
1
2
3
4
21
1
2
3
4
22
23
24
1
2
3
25
1
2
3
4
26
1
2
3
27
28
1
2
3
4
29
30
1
2
3
4
31
32
1
2
3
33
34
35
1
2
3
4
36
37
38
1
2
3
39
1
2
3
40
1
2
3
41
42
1
2
3
43
44
45
46
1
2
3
47
1
2
3
48
49
50
51
52
53
54
55
56
57
58
1
2
3
4
5
6
7
59
60
1
2
3
4
5
6
7
61
62
1
2
3
63
64
65
1
2
3
66
67
68
69
70
71
72
73
74
75
1
2
3
76
77
1
2
3
4
78
1
2
3
79
80
81
82
83
84
85
86
1
2
3
87
1
2
3
88
89
90
1
2
3
4
5
6
7
91
92
1
2
3
93
1
2
3
94
1
2
3
95
96
97
4A
98
1
2
3
99
1
2
3
100
101
1
2
3
102
1
2
3
103
1
2
3
104
105
1
2
3
106
1
2
3
107
1
2
3
108
109
1
2
3
110
1
2
3
4
111
1
2
3
4
112
1
2
3
113
114
1
2
3
115
1
2
3
116
117
118
1
2
3
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
1
2
3
135
1
2
3
4
5
136
1
2
3
137
1
2
3
138
139
1
2
3
4
140
1
2
3
4
141
1
2
3
142
143
144
1
2
3
145
1
2
3
146
1
2
3
147
1
2
3
148
5
149
150
151
1
2
3
152
1
2
3
153
154
1
2
3
155
1
2
3
156
1
2
3
157
1
2
3
158
159
1
2
3
160
1
2
3
161
162
1
2
3
163
1
2
3
164
1
2
3
165
1
2
3
166
1
2
3
4
167
168
1
2
3
4
5
169
1
2
3
170
1
2
3
171
172
173
1
2
3
174
1
2
3
175
176
1
2
3
177
178
179
1
2
3
180
181
1
2
3
182
1
2
3
4
183
1
2
3
184
1
2
3
4
185
1
2
3
186
1
2
3
4
187
188
189
1
2
3
190
1
2
3
191
192
193
194
195
196
1
2
3
197
198
199
200
2
201
202
7
203
1
2
3
204
1
2
3
4
205
1
2
3
206
207
208
1
2
3
209
210
1
2
3
4
211
212
213
1
2
3
214
1
2
3
215
216
1
2
3
217
1
2
3
218
1
2
3
219
1
2
3
220
1
2
3
221
1
2
3
222
1
2
3
223
1
2
3
224
225
1
2
3
226
1
2
3
227
1
2
3
228
229
1
2
3
230
231
1
232
233
2
3
234
235
1
2
3
236
1
2
3
237
1
2
3
4
5
238
1
2
3
4
5
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
1
2
3
259
260
261
262
263
264
265
266
267
268
269
270
271
272
1
2
3
273
274
275
276
277
278
1
2
3
279
280
1
2
3
281
1
2
3
282
3
283
284
1
2
3
285
1
2
3
286
287
288
289
290
291
292
293
1
2
3
4
5
294
295
296
297
298
1
2
3
299
1
2
3
4
5
300
1A
1B
301
302
1
2
3
303
304
305
306
1
2
3
307
1
2
3
4
5
6
7
308
309
310
311
1
2
3
312
1
2
3
4
5
6
313
1
2
3
314
315
316
1
2
3
317
1
2
3
4
318
319
320
1
2
3
4
321
322
1
2
3
4
323
324
1
2
3
4
5
325
326
1
2
3
327
4
328
329
330
331
4
332
333
334
335
1
2
3
336
1
2
3
337
1
2
3
338
1
2
3
4
339
1
2
3
4
5
6
340
1
2
3
4
5
6
341
342
343
1
2
3
344
1
2
3
345
346
347
1
2
3
348
1
2
3
349
1
2
3
350
351
352
353
1
2
3
354
3
355
1
2
3
4
356
1
2
3
4
357
358
1
2
3
359
1
2
3
360
361
362
363
1
2
3
4
5
364
1
2
3
365
1
2
3
366
367
368
1
2
3
369
1
2
3
370
371
372
1
2
3
4
373
374
375
376
377
378
1
2
3
4
379
1
2
3
4
380
381
382
383
384
1
2
3
4
5
6
385
386
1
2
3
387
1
2
3
388
389
1
2
3
390
391
392
393
394
395
396
1
2
3
397
1
2
3
398
399
400
1
2
3
4
401
402
403
404
405
406
1
2
3
1
2
1
2
1
2
1
2
1
2
1
2
3
4
5
1
2
3
1
2
1
2
1
2
1
2
1
2
3
4
407
408
409
410
411
412
413
414
415
1
2
3
4
5
416
1
2
3
417
1
2
3
418
419
420
1
2
3
4
421
422
423
1
2
3
424
425
1
2
3
4
5
6
426
427
1
2
3
428
429
1
2
3
4
430
1
2
3
431
1
2
3
432
1
2
3
4
5
6
7
8
433
434
1
1
2
2
1
2
3
4
3
1
2
4
1
2
5
1
2
6
1
2
3
7
1
2
3
8
9
1
2
3
4
10
1
2
3
11
12
13
14
1
2
15
16
17
1
2
3
4
18
1
2
3
4
5
6
7
8
19
1
2
3
20
1
2
21
1
2
3
22
1
2
23
24
1
2
3
4
25
1
2
26
1
2
27
1
2
3
28
1
2
3
4
29
1
2
30
1
2
3
31
1
2
3
32
1
2
3
4
5
6
33
1
2
34
1
2
35
1
2
36
1
2
37
1
2
3
4
38
1
2
3
4
39
1
2
40
1
2
3
41
1
2
3
42
1
2
43
1
2
44
45
46
1
2
47
1
2
3
48
1
2
3
49
1
2
3
50
51
52
1
2
3
4
53
1
2
54
1
2
55
1
2
56
1
2
3
4
57
58
1
2
3
4
59
60
1
2
3
4
61
1
2
3
4
1 The applied GPDR
2 Merger of the directly applicable GDPR and the applied GDPR
1
2
3
3
1
2
4 UK GDPR: transfers approved by regulations
1
2
3
4
5
6
7 UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
9 UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules
1
2
3
4
5
5A
5B
5C
6
7
8
10 Part 3 (law enforcement processing): transfers approved by regulations
1
2
3
4
5
6
5
1
2
3
4
5
6
6
1
2
3
8
11
1
2
3
4
5
12
1
2
13 Applied GDPR: power to make provision in consequence of GDPR regulations
1
2
3
14 Applied GDPR: national security certificates
1
2
15 Confidentiality of information
16 GDPR: maximum amount of penalties
17 GDPR: right to an effective remedy against the Commissioner
1
2