(a) processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed under the regulations to provide information is to be taken into account);
(b) provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
(7) Before making regulations under this section the Secretary of State must consult—
(a) OFCOM,
(b) the Information Commissioner,
(c) persons who appear to the Secretary of State to represent providers of regulated services,
(d) persons who appear to the Secretary of State to represent the interests of persons carrying out independent research into online safety matters, and
(8) For the purposes of this section—
(a) “independent research” is research carried out other than on behalf of a provider of a regulated service;
(b) references to an “appropriate person” are references to—
(i) OFCOM, or
(ii) such other person as the Secretary of State considers appropriate to carry out functions under regulations made under this section (and the regulations may include provision establishing a body for this purpose). ”
(3) In section 162 (OFCOM’s report about researchers’ access to information), omit subsections (7) to (10).
(4) In section 225 (Parliamentary procedure for regulations), for subsections (8) and (9) substitute—
“ (8) A statutory instrument containing (whether alone or with other provision) the first regulations under the following provisions may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament—
(a) section 154A(1);
(b) paragraph 1(1) of Schedule 11.
(9) Any other statutory instrument containing regulations under a provision mentioned in subsection (8) is subject to annulment in pursuance of a resolution of either House of Parliament. ”
(5) The requirement to consult under section 154A(7) of the Online Safety Act 2023 (as inserted by subsection (2) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
I229 S. 125 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I230 S. 125 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904 , reg. 2(s)
Retention of biometric data U.K.
126 Retention of biometric data and recordable offences U.K.
(1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (10).
(2) In section 18A(3) (retention of material: general), after “recordable offence” insert “or recordable-equivalent offence” .
(3) Section 18E (supplementary provision) is amended in accordance with subsections (4) to (10).