5. UK GDPR regulations are to be made by statutory instrument.
6. For the purposes of this Regulation, where regulations are subject to “the negative resolution procedure”, the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
7. For the purposes of this Regulation, where regulations are subject to “the affirmative resolution procedure”, the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
8. For the purposes of this Regulation, where regulations are subject to “the made affirmative resolution procedure”—
(a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and
(b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
9. In calculating the period of 120 days, no account is to be taken of any whole days that fall within a period during which—
(a) Parliament is dissolved or prorogued, or
(b) both Houses of Parliament are adjourned for more than 4 days.
10. Where regulations cease to have effect as a result of paragraph 8, that does not—
(a) affect anything previously done under the regulations, or
(b) prevent the making of new regulations.
11. Any provision that may be included in UK GDPR regulations subject to the negative resolution procedure may be made by regulations made under this Regulation or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.
12. A requirement under this Article to consult may be satisfied by consultation before, as well as by consultation after, the provision conferring the power to make regulations comes into force.
13. In this Article, “ urgency statement ”, in relation to regulations, means a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay. ”
(2) In section 3(9) of the 2018 Act (definition of “data protection legislation”), in paragraph (d), after “Act” insert “or the UK GDPR” .
I195 S. 107 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I196 S. 107 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904 , reg. 2(l)
108 Further minor provision about data protection U.K.
Schedule 11 contains further minor provision about data protection.
I197 S. 108 not in force at Royal Assent, see s. 142(1)
I198 S. 108 in force at 20.8.2025 by S.I. 2025/904 , reg. 2(m)
Chapter 2 U.K. Privacy and electronic communications
109 The PEC Regulations U.K.
In this Chapter, “ the PEC Regulations ” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 ( S.I. 2003/2426 ).
I199 S. 109 not in force at Royal Assent, see s. 142(1)