PART 1Preliminary

1Overview

(1)This Act makes provision about the processing of personal data.

(2)Most processing of personal data is subject to the GDPR.

(3)Part 2 supplements the GDPR (see Chapter 2) and applies a broadly equivalent regime to certain types of processing to which the GDPR does not apply (see Chapter 3).

(4)Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes and implements the Law Enforcement Directive.

(5)Part 4 makes provision about the processing of personal data by the intelligence services.

(6)Part 5 makes provision about the Information Commissioner.

(7)Part 6 makes provision about the enforcement of the data protection legislation.

(8)Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliament.

2Protection of personal data

(1)The GDPR, the applied GDPR and this Act protect individuals with regard to the processing of personal data, in particular by-

(a)requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis,

(b)conferring rights on the data subject to obtain information about the processing of personal data and to require inaccurate personal data to be rectified, and

(c)conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.

(2)When carrying out functions under the GDPR, the applied GDPR and this Act, the Commissioner must have regard to the importance of securing an appropriate level of protection for personal data, taking account of the interests of data subjects, controllers and others and matters of general public interest.

3Terms relating to the processing of personal data

(1)This section defines some terms used in this Act.

(2)"Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3)"Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to-

(a)an identifier such as a name, an identification number, location data or an online identifier, or

(b)one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4)"Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as-

(a)collection, recording, organisation, structuring…