“ intra-group transmission ” means transmission between members of a group of undertakings or between members of a group of institutions affiliated to a central body;
“ security of network and information systems ” has the same meaning as in the Network and Information Systems Regulations 2018 ( S.I. 2018/506 ) (see regulation 1(3)(g)). ”
(5) In Article 21(1) (right to object), after “point (e)” insert “, (ea)” .
(6) Schedule 4 to this Act inserts Annex 1 to the UK GDPR.
(7) In section 8 of the 2018 Act (lawfulness of processing: public interest etc), omit “the controller’s”.
(8) In the provisions listed in subsection (9)—
(a) for “gateway” substitute “gateways” , and
(b) for “were omitted” substitute “disapplied only the gateway in point (ea) (recognised legitimate interests)” .
(9) The provisions are—
(a) section 40(8) of the Freedom of Information Act 2000 (personal data which is exempt information);
(b) section 38(5A) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);
(c) regulation 13(6) of the Environmental Information Regulations 2004 ( S.I. 2004/3391 ) (restriction on disclosure of personal data);
(d) regulation 11(7) of the Environmental Information (Scotland) Regulations 2004 ( S.S.I. 2004/520 ) (restriction on disclosure of personal data);
(e) regulation 45(1E) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 ( S.I. 2005/2042 ) (personal data which is sensitive information);
(f) regulation 39(1E) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 ( S.S.I. 2005/494 ) (personal data which is sensitive information);
(g) regulation 9(9) of the INSPIRE Regulations 2009 ( S.I. 2009/3157 ) (limitation of public access to personal data included in a spatial data set);
(h) regulation 10(8) of the INSPIRE (Scotland) Regulations 2009 ( S.S.I. 2009/440 ) (limitation of public access to personal data included in a spatial data set).
I123 S. 70 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I124 S. 70 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82 , reg. 2(c)
71 The purpose limitation U.K.
(2) In Article 5(1)(b) (purpose limitation)—
(a) after “collected” insert “(whether from the data subject or otherwise)” ,
(b) after “further processed” insert “by or on behalf of a controller” , and
(c) for the words from “those purposes;” to “initial purposes” substitute “the purposes for which the controller collected the data” .
(3) In Article 5, at the end insert—
“ 3. For the avoidance of doubt, processing is not lawful by virtue only of being processing in a manner that is compatible with the purposes for which the personal data was collected. ”