(ii) omit paragraph (c) (and the “and” after it).
(5) After section 186 insert—
“ 186A Protection of data subject’s rights: further provision
(a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and
(b) a provision of the UK GDPR or this Act listed in section 186(2).
(3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).
(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.
(5) In this section, “ pre-commencement enactment ” means an enactment so far as passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3). ”
(6) In section 5 of the European Union (Withdrawal) Act 2018 (exceptions to savings and incorporation), in subsection (A3)(a)—
(a) for “section” substitute “sections 183A and” ,
(b) for “(data subject’s rights and other prohibitions and restrictions)” substitute “(protection of prohibitions, restrictions and data subject’s rights)” , and
(c) at the end insert “(and see also section 183B(3) of that Act)” .
(7) Subsections (3), (5) and (6)(c) are to be treated as having come into force on 1 January 2024.
I193 S. 106 not in force at Royal Assent, see s. 142(1)
I194 S. 106 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(k)
Miscellaneous U.K.
107 Regulations under the UK GDPR U.K.
(1) In the UK GDPR, after Chapter 9 insert—
“ CHAPTER 9A U.K. Regulations
Article 91A Regulations made by Secretary of State
1. This Article makes provision about regulations made by the Secretary of State under this Regulation (“ UK GDPR regulations ”).
2. Before making UK GDPR regulations, the Secretary of State must consult—
(a) the Commissioner, and
3. Paragraph 2 does not apply to regulations made under Article 49 or 49A where the Secretary of State has made an urgency statement in respect of them.
4. UK GDPR regulations may—
(b) include consequential, supplementary, incidental, transitional, transitory or saving provision.