I482 Sch. 11 para. 5 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
6 In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)” .
I483 Sch. 11 para. 6 not in force at Royal Assent, see s. 142(1)
I484 Sch. 11 para. 6 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
7 In Article 24(3) (responsibility of the controller), for “an element by which to demonstrate” substitute “a means of demonstrating” .
I485 Sch. 11 para. 7 not in force at Royal Assent, see s. 142(1)
I486 Sch. 11 para. 7 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
8 In Article 25(3) (data protection by design and by default), for “an element to demonstrate” substitute “a means of demonstrating” .
I487 Sch. 11 para. 8 not in force at Royal Assent, see s. 142(1)
I488 Sch. 11 para. 8 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
9 In Article 28(5) (processors), for “an element by which to demonstrate” substitute “a means of demonstrating” .
I489 Sch. 11 para. 9 not in force at Royal Assent, see s. 142(1)
I490 Sch. 11 para. 9 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
10 In Article 32(3) (security of processing), for “an element by which to demonstrate” substitute “a means of demonstrating” .
I491 Sch. 11 para. 10 not in force at Royal Assent, see s. 142(1)
I492 Sch. 11 para. 10 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
11 In Article 37(1)(a), after “courts” insert “and tribunals” .
I493 Sch. 11 para. 11 not in force at Royal Assent, see s. 142(1)
I494 Sch. 11 para. 11 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
12 Omit Article 59 (activity reports).
I495 Sch. 11 para. 12 not in force at Royal Assent, see s. 142(1)
I496 Sch. 11 para. 12 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
13 The 2018 Act is amended as follows.
I497 Sch. 11 para. 13 not in force at Royal Assent, see s. 142(1)
I498 Sch. 11 para. 13 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(y)
14 U.K. In section 3(9) (definition of “the data protection legislation”)—