I155 S. 86 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I156 S. 86 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82 , reg. 2(n)
87 Section 86: consequential provision U.K.
(1) In the UK GDPR—
(a) in Article 5(1)(e) (storage limitation), for “Article 89(1)” to “data subject” substitute “Article 84B” ,
(b) in Article 9(2)(j) (processing of special categories of personal data), for “in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act)” substitute “, is carried out in accordance with Article 84B and is” ,
(c) in Article 17(3)(d) (right to erasure), for “Article 89(1)” substitute “Article 84B” , and
(d) in Article 21(6) (right to object), omit “pursuant to Article 89(1)”.
(2) In the 2018 Act—
(a) in section 24(4) (manual unstructured data held by FOI public authorities), after paragraph (b) insert—
“ (ba) Chapter 8A (safeguards for processing for research, archiving or statistical purposes); ” ,
(b) in paragraph 4(b) of Schedule 1 (special categories of personal data and criminal convictions etc data: research etc), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR” , and
(c) in Schedule 2 (exemptions etc from the UK GDPR)—
(i) in paragraph 27(3)(a) (research and statistics), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR” , and
(ii) in paragraph 28(3) (archiving), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR” .
(3) In section 279(2) of the Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13) (information for research), for “Article 89(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics)” substitute “Article 84A of the UK GDPR (research, archives and statistics)” .
I157 S. 87 not in force at Royal Assent, see s. 142(1)
I158 S. 87 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(o)
National security U.K.
88 National security exemption U.K.
(1) The 2018 Act is amended in accordance with subsections (2) to (10).
(2) In section 26(2)(f) (national security and defence exemption), before sub-paragraph (i) insert—
“ (ai) Article 77 (right to lodge a complaint with the Commissioner); ” .
(3) In section 44 (controller’s general duties to provide information to data subject)—
(a) in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),
(b) in subsection (5), after “restricted” insert “under subsection (4)” , and