Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Part 5Data protection and privacy

Chapter 1Data protection

Information Commissioner’s role

92Codes of practice for the processing of personal data

(1)

The 2018 Act is amended in accordance with subsections (2) to (6).

(2)

After section 124 insert—

“124AOther codes of practice

(1)

The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.

(2)

Regulations under this section—

(a)

must describe the personal data or processing to which the code of practice is to relate, and

(b)

may describe the persons or classes of person to whom it is to relate.

(3)

Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(4)

Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

(a)

trade associations;

(b)

data subjects;

(c)

persons who appear to the Commissioner to represent the interests of data subjects.

(5)

A code under this section may include transitional provision or savings.

(6)

Regulations under this section are subject to the negative resolution procedure.

(7)

In this section—

“good practice in the processing of personal data” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;

“trade association” includes a body representing controllers or processors.”

(3)

In section 125 (approval of codes prepared under sections 121 to 124)—

(a)

in the heading, for “124” substitute “124A”,

(b)

in subsection (1), for “or 124” substitute “, 124 or 124A”,

(c)

in subsection (3), for “or 124” substitute “, 124 or 124A”,

(d)

for subsection (5) substitute—

“(5)

If the Commissioner is prevented by subsection (3) from issuing a code that is not a replacement code, the Commissioner must prepare another version of the code.”, and

(e)

in subsection (9), for “or 124” substitute “, 124 or 124A”.

(4)

In section 126 (publication and review of codes issued under section 125(4)), in subsection (4), for “or 124(2)” substitute “, 124(2) or 124A(3)”.

(5)

Omit section 128 (other codes of practice).

(6)

In section 129 (consensual audits), in subsection (3), for “128” substitute “124A”.

(7)

In section 19AC of the Registration Service Act 1953 (code of practice), in subsection (11), for “128” substitute “124A”.

(8)

In the Statistics and Registration Service Act 2007—

(a)

in section 45 (information held by HMRC), in subsection (4A), for “128” substitute “124A”,

(b)

in section 45A (information held by other public authorities), in subsection (8), for “128” substitute “124A”,

(c)

in section 45E (further provisions about powers in sections 45B, 45C and 45D), in subsection (16), for “128” substitute “124A”, and

(d)

in section 53A (disclosure by the Board to devolved administrations), in subsection (9), for “128” substitute “124A”.

(9)

In the Digital Economy Act 2017—

(a)

in section 43 (code of practice), in subsection (13), for “128” substitute “124A”,

(b)

in section 52 (code of practice), in subsection (13), for “128” substitute “124A”,

(c)

in section 60 (code of practice), in subsection (13), for “128” substitute “124A”, and

(d)

in section 70 (code of practice), in subsection (15), for “128” substitute “124A”.