13 amended provisions across 3 instruments, each shown before and after with the words that changed highlighted, the date it took effect, and, where held, the exact statutory wording now in force.
No statutory duty on controllers to handle complaints. A complaint went straight to the regulator.
Controllers must make complaints easy to lodge, acknowledge them within 30 days and respond without undue delay. The regulator comes second.
Effect summary in the site's own words, not statutory text.
A data subject may make a complaint to the controller.
The Information Commissioner, a corporation sole.
The Information Commission, a body corporate led by a board, with the same role and powers.
Effect summary in the site's own words, not statutory text.
Information notices, assessment notices, enforcement notices and penalty notices.
Information notices, assessment notices, interview notices, a power to require a report, enforcement notices and penalty notices.
Effect summary in the site's own words, not statutory text.
Notify the regulator of a personal data breach within 24 hours of detection.
Notify the regulator without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.
Effect summary in the site's own words, not statutory text.
where feasible, not later than 72 hours after having become aware of it
Consent for any storage or access except for transmission or where strictly necessary for a requested service.
Consent for any storage or access except for transmission, where strictly necessary, for statistical purposes, for website appearance, or for emergency assistance, on conditions.
Effect summary in the site's own words, not statutory text.
Monetary penalties of up to £500,000.
Penalties of up to the higher of £17.5m or 4% of worldwide turnover, under the DPA 2018 enforcement toolkit.
Effect summary in the site's own words, not statutory text.
Soft opt-in for contact details obtained in a sale or negotiation for a sale only.
Soft opt-in for contact details obtained in a sale or negotiation for a sale, plus a charity soft opt-in for supporters, on conditions.
Effect summary in the site's own words, not statutory text.
Six lawful bases. Legitimate interests always needs the balancing test against the interests and rights of the person.
Seven lawful bases. A recognised legitimate interest listed in Annex 1 needs no balancing test, only a condition in Annex 1.
Effect summary in the site's own words, not statutory text.
processing is necessary for the purposes of a recognised legitimate interest;
One month to respond, extendable by two months. Pausing the clock for identity or clarification rests on guidance.
One month to respond, extendable by two months. The clock stops by statute while the controller reasonably waits for identity or clarification.
Effect summary in the site's own words, not statutory text.
Right of access to the personal data and the supplementary information, with no codified limit on the search.
Right of access limited to what the controller can provide based on a reasonable and proportionate search.
Effect summary in the site's own words, not statutory text.
Under paragraph 1, the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search.
A right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, unless one of three exceptions applies.
Decisions based solely on automated processing with legal or similarly significant effects are permitted with safeguards, with tighter limits where special category data is used.
Effect summary in the site's own words, not statutory text.
there is no meaningful human involvement in the taking of the decision
Data protection by design and by default, with no express reference to children.
Data protection by design and by default must take account of children's higher protection matters where a service is likely to be accessed by children.
Effect summary in the site's own words, not statutory text.
Transfers assessed against the inherited EU standard of essentially equivalent protection.
Transfers assessed against the data protection test: protection not materially lower than in the UK.
Effect summary in the site's own words, not statutory text.