Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Part 5Data protection and privacy

Chapter 1Data protection

Codes of conduct

83General processing and codes of conduct

In Article 41 of the UK GDPR (monitoring of approved codes of conduct)—

(a)

in paragraph 4, omit the words from “, including suspension” to the end, and

(b)

after that paragraph insert—

“4A.

If the action taken by a body under paragraph 4 consists of suspending or excluding a controller or processor from the code, the body must inform the Commissioner, giving reasons for taking that action.”

84Law enforcement processing and codes of conduct

(1)

The 2018 Act is amended as follows.

(2)

In section 55(1) (overview and scope of provisions about controllers and processors), at the end insert—

“(e)

makes provision about codes of conduct (see section 71A).”

(3)

In section 56 (general obligations of the controller), at the end insert—

“(4)

Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.”

(4)

In section 59 (processors), after subsection (7) insert—

“(7A)

Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).”

(5)

In section 66 (security of processing), at the end insert—

“(3)

Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).”

(6)

After section 71 insert—

“Codes of conduct

71ACodes of conduct

(1)

The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.

(2)

Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.

(3)

For the purposes of this section—

(a)

“public body” means a body or other person whose functions are, or include, functions of a public nature, and

(b)

a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).

(4)

A code of conduct described in subsection (1) may, for example, make provision with regard to—

(a)

lawful and fair processing;

(b)

the collection of personal data;

(c)

the information provided to the public and to data subjects;

(d)

the exercise of the rights of data subjects;

(e)

the measures and procedures referred to in sections 56, 57 and 62;

(f)

the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;

(g)

the transfer of personal data to third countries or international organisations;

(h)

out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.

(5)

The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.

(6)

Where an expert public body does so, the Commissioner must—

(a)

provide the body with an opinion on whether the code correctly reflects the requirements of this Part,

(b)

decide whether to approve the code, and

(c)

if the code is approved, register and publish the code.

(7)

Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.”