(2) In the heading before paragraph 10, for “or detecting” substitute “etc” .
(3) In paragraph 10(1)(a) (preventing etc unlawful acts), after “prevention” insert “, investigation” .
(4) In paragraph 13(1)(a) (journalism etc in connection with unlawful acts and dishonesty etc), after “consists of” insert “, or is carried out in preparation for,” .
(5) In paragraph 14(1)(b) (preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—
“ (iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), ” .
(6) In paragraph 24(1)(a) (disclosure to elected representatives), after “consists of” insert “, or is carried out in preparation for,” .
I527 Sch. 11 para. 28 not in force at Royal Assent, see s. 142(1)
I528 Sch. 11 para. 28 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z12)
29 (1) Schedule 2 (exemptions etc from the UK GDPR) is amended as follows. U.K.
(2) In paragraph 2(1)(a) (crime), after “prevention” insert “, investigation” .
(3) In paragraph 3(2)(b)(ii) (crime: risk assessment systems), after “prevention” insert “, investigation” .
I529 Sch. 11 para. 29 not in force at Royal Assent, see s. 142(1)
I530 Sch. 11 para. 29 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z12)
30 U.K. In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing under Part 3: preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—
I531 Sch. 11 para. 30 not in force at Royal Assent, see s. 142(1)
I532 Sch. 11 para. 30 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z12)
31 U.K. In paragraph 2(a) of Schedule 11 (other exemptions under Part 4: crime), after “prevention” insert “, investigation” .
I533 Sch. 11 para. 31 not in force at Royal Assent, see s. 142(1)
I534 Sch. 11 para. 31 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z12)
Victims and Prisoners Act 2024 U.K.
32 The following provisions (inserted by section 31 of the Victims and Prisoners Act 2024) extend to Scotland and Northern Ireland (as well as to England and Wales)—
(a) Article 17(1)(g), (4) and (5) of the UK GDPR (right to erasure), and
(b) section 13A of the 2018 Act (meaning of “relevant offence” for purpose of right to erasure).
I535 Sch. 11 para. 32 not in force at Royal Assent, see s. 142(1)
I536 Sch. 11 para. 32 in force at 31.3.2026 by S.I. 2026/317 , reg. 3
Section 112