(2) In that section—
(a) subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the eIDAS Regulation or the EITSET Regulations” ;
(b) subsection (6)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15” ;
(c) subsection (7) has effect as if for “this Act (other than an offence under section 148C)” there were substituted “section 144 or 148 or paragraph 15 of Schedule 15” . ”
(7) In paragraph 12 (modification of Schedule 15 (powers of entry and inspection)), in sub-paragraph (2), in the substituted paragraph (a), for “or 148” substitute “, 148 or 148C”.
(8) In paragraph 13 (modification of section 155 (penalty notices)), in sub-paragraph (3)(c), for “for “data subjects”” there were substituted “for the words from “data subjects” to the end” .
(9) Omit paragraph 21 (modification of section 182 (regulations and consultation)) and the heading before it.
(10) In paragraph 22 (modification of section 196 (penalties for offences)), in sub-paragraph (2)(b)—
(a) after “148”, in the first place it occurs, insert “, 148C” , and
(b) for “or 148” substitute “, 148 or 148C” .
I191 S. 105 not in force at Royal Assent, see s. 142(1)
I192 S. 105 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(u)
Protection of prohibitions, restrictions and data subject’s rights U.K.
106 Protection of prohibitions, restrictions and data subject’s rights U.K.
(1) The 2018 Act is amended in accordance with subsections (2) to (5).
(2) After section 183 insert—
“ Prohibitions and restrictions etc on processing U.K.
183A Protection of prohibitions and restrictions etc on processing: relevant enactments
(1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.
(2) Subsection (1) does not apply—
(a) to a relevant enactment forming part of the main data protection legislation, or
(b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).
(3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.
(4) In this section—
“ the main data protection legislation ” means the data protection legislation other than provision of or made under— (a) Chapter 6 or 8 of the UK GDPR, or (b) Parts 5 to 7 of this Act;
“ relevant enactment ” means an enactment so far as passed or made on or after the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force;