Section 78 | Searches in response to data subjects’ requests

(1)In Article 15 of the UK GDPR (right of access by the data subject)—

(a)after paragraph 1 insert—

(1A)Under paragraph 1, the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that paragraph.

, and

(b)in paragraph 3, after “processing” insert “to which the data subject is entitled under paragraph 1”.

(2)The 2018 Act is amended in accordance with subsections (3) and (4).

(3)In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—

(2A)Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

(4)In section 94 (intelligence services processing: right of access by the data subject), after subsection (2) insert—

(2A)Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

(5)The amendments made by this section are to be treated as having come into force on 1 January 2024.