Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 91A – Regulations made by Secretary of State
Articles
Article 91A[F1Regulations made by Secretary of State
1. This Article makes provision about regulations made by the Secretary of State under this Regulation (“UK GDPR regulations”).
2. Before making UK GDPR regulations, the Secretary of State must consult—
- (a)the [F2Commission], and
- (b)such other persons as the Secretary of State considers appropriate.
3. Paragraph 2 does not apply to regulations made under Article 49 or 49A where the Secretary of State has made an urgency statement in respect of them.
4. UK GDPR regulations may—
- (a)make different provision for different purposes;
- (b)include consequential, supplementary, incidental, transitional, transitory or saving provision.
5. UK GDPR regulations are to be made by statutory instrument.
6. For the purposes of this Regulation, where regulations are subject to “the negative resolution procedure”, the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
7. For the purposes of this Regulation, where regulations are subject to “the affirmative resolution procedure”, the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
8. For the purposes of this Regulation, where regulations are subject to “the made affirmative resolution procedure”—
- (a)the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and
- (b)the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
9. In calculating the period of 120 days, no account is to be taken of any whole days that fall within a period during which—
- (a)Parliament is dissolved or prorogued, or
- (b)both Houses of Parliament are adjourned for more than 4 days.
10. Where regulations cease to have effect as a result of paragraph 8, that does not—
- (a)affect anything previously done under the regulations, or
- (b)prevent the making of new regulations.
11. Any provision that may be included in UK GDPR regulations subject to the negative resolution procedure may be made by regulations made under this Regulation or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.
12. A requirement under this Article to consult may be satisfied by consultation before, as well as by consultation after, the provision conferring the power to make regulations comes into force.
13. In this Article, “urgency statement”, in relation to regulations, means a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.]
Amended text
This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations and footnotes
Textual Amendments
- F1 Ch. 9A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 107(1), 142(1)(2)(h); S.I. 2025/904, reg. 2(l)
- F2 Word in Art. 91A(2)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(z9); S.I. 2026/1015, reg. 2(c)
https://uk-gdpr.digiphile.law/article/article-91A.html
Text as at 17 September 2026.
This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.