“ 5. Paragraph 3 does not apply to the extent that—
(a) the controller intends to further process the personal data—
(i) for (and only for) the purposes of scientific or historical research, the purposes of archiving in the public interest or statistical purposes, and
(ii) in accordance with Article 84B, and
(b) providing the information is impossible or would involve a disproportionate effort.
6. For the purposes of paragraph 5(b), whether providing the information would involve a disproportionate effort depends on, among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing.
7. A controller relying on paragraph 5 must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information available publicly. ”
(2) In Article 14 of the UK GDPR (information to be provided where personal data is not obtained from the data subject)—
(a) in paragraph 5—
(i) for “shall not apply where and insofar as” substitute “do not apply to the extent that” ,
(ii) omit point (b),
(iii) omit the “or” at the end of point (c),
(iv) in point (d), omit “where”, and
(v) after that point insert—
“ (e) providing the information is impossible or would involve a disproportionate effort, or
(f) the obligation referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of the processing for which the personal data are intended. ” , and
“ 6. For the purposes of paragraph 5(e), whether providing the information would involve a disproportionate effort depends on, among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing.
7. A controller relying on paragraph 5(e) or (f) must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information available publicly. ”
I139 S. 77 not in force at Royal Assent, see s. 142(1)
I140 S. 77 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(i)
78 Searches in response to data subjects’ requests U.K.
(1) In Article 15 of the UK GDPR (right of access by the data subject)—
(a) after paragraph 1 insert—
“ 1A. Under paragraph 1, the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that paragraph. ” , and
(b) in paragraph 3, after “processing” insert “to which the data subject is entitled under paragraph 1” .
(2) The 2018 Act is amended in accordance with subsections (3) and (4).