Adherence to a code of conduct approved under regulation 32A may be used by a person as a means of demonstrating compliance with these Regulations. ”
(3) In regulation 33 (technical advice to the Commissioner)—
(a) omit “, in connection with his enforcement functions,” and
(b) at the end insert “ where the request is made in connection with—
(a) the Commissioner’s enforcement functions, or
(b) the Commissioner’s functions under regulation 32A or 32B (codes of conduct). ”
(4) In Schedule 1 (Commissioner’s enforcement powers) (inserted by Schedule 13 to this Act), in paragraph 18(b)(ii) (maximum amount of penalty), for “or 24” substitute “, 24 or 32B(4) or (5)” .
I214 S. 116 not in force at Royal Assent, see s. 142(1)
I215 S. 116 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z)
Part 6 U.K. The Information Commission
117 The Information Commission U.K.
(1) The Data Protection Act 2018 is amended in accordance with subsections (2) to (5).
(2) After section 114 insert—
“ The Information Commission U.K.
114A The Information Commission
(1) A body corporate called the Information Commission is established.
(2) Schedule 12A makes further provision about the Commission. ”
(3) In section 3 (terms relating to the processing of personal data), after subsection (8) insert—
“ (8A) “ The Commission ” means the Information Commission (see section 114A). ”
(4) In section 205(2) (references to periods of time)—
(a) omit paragraph (l), and
“ (la) paragraph 22(6) of Schedule 12A; ” .
(5) In section 206 (index of defined expressions), in the Table, at the appropriate place insert—
(6) Schedule 14 to this Act—
(a) inserts Schedule 12A to the Data Protection Act 2018, and
(b) makes transitional provision relating to—