I462 Sch. 10 para. 16 in force at 19.6.2026 by S.I. 2026/82 , reg. 3(b) (with reg. 7 )
17 In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)” .
I463 Sch. 10 para. 17 not in force at Royal Assent, see s. 142(1)
I464 Sch. 10 para. 17 in force at 19.6.2026 by S.I. 2026/82 , reg. 3(b) (with reg. 7 )
18 In section 157 (maximum amount of penalty), after subsection (4) insert—
“ (4A) In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount. ”
I465 Sch. 10 para. 18 not in force at Royal Assent, see s. 142(1)
I466 Sch. 10 para. 18 in force at 19.6.2026 by S.I. 2026/82 , reg. 3(b) (with reg. 7 )
19 In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner” .
I467 Sch. 10 para. 19 not in force at Royal Assent, see s. 142(1)
I468 Sch. 10 para. 19 in force at 19.6.2026 by S.I. 2026/82 , reg. 3(b) (with reg. 7 )
20 (1) Section 166 (orders to progress complaints) is amended as follows.
(2) In the heading, at the end insert “to the Commissioner” .
(3) In subsection (1), omit “or Article 77 of the UK GDPR”.
I469 Sch. 10 para. 20 not in force at Royal Assent, see s. 142(1)
I470 Sch. 10 para. 20 in force at 19.6.2026 by S.I. 2026/82 , reg. 3(b) (with reg. 7 )
21 (1) Section 187 (representation of data subjects with their authority) is amended as follows.
(2) In subsection (1)(a)—
(a) for “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles” , and
(b) omit “to lodge complaints and”.
(3) In subsection (2)—
(a) before paragraph (a) insert—
“ (za) the right under section 164A (complaints to the controller); ” , and
(b) in paragraph (a), for “165(2) and (4)(d)” substitute “165” .
I471 Sch. 10 para. 21 not in force at Royal Assent, see s. 142(1)
I472 Sch. 10 para. 21 in force at 19.6.2026 by S.I. 2026/82 , reg. 3(b) (with reg. 7 )