(5) In Article 57 (Commissioner’s tasks)—
(a) in paragraph 1, omit point (f), and
(b) omit paragraph 2.
(6) Omit Article 77 (right to lodge a complaint with the Commissioner).
(7) Schedule 10 to this Act contains minor and consequential amendments.
I187 S. 103 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I188 S. 103 in force at 19.6.2026 in so far as not already in force by S.I. 2026/82 , reg. 3(a) (with reg. 7 )
104 Court procedure in connection with subject access requests U.K.
(2) For the italic heading before section 180 substitute—
“ Jurisdiction and court procedure ” .
(3) After section 180 insert—
“ 180A Procedure in connection with subject access requests
(1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—
(a) Article 15 of the UK GDPR (right of access by the data subject);
(b) Article 20 of the UK GDPR (right to data portability);
(c) section 45 of this Act (law enforcement processing: right of access by the data subject);
(d) section 94 of this Act (intelligence services processing: right of access by the data subject).
(2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.
(3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.
(4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision. ”
I189 S. 104 not in force at Royal Assent, see s. 142(1)
I190 S. 104 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(j)
105 Consequential amendments to the EITSET Regulations U.K.
(1) Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 ( S.I. 2016/696 ) (Commissioner’s enforcement powers) is amended as follows.
(2) In paragraph 1 (provisions of the 2018 Act applied for enforcement purposes)—
(a) after paragraph (g) insert—