Subsections (1) to (5) of section 106 amend the DPA 2018 by inserting new section 183A, 183B and 186A into the DPA 2018 as well as making amendments to existing section 186. The purpose of these provisions is to ensure there are clearer rules about the relationship between key elements of the data protection legislation and: (i) other provisions in legislation or rules of law relating to the processing of personal data, and (ii) restrictions or prohibitions in legislation on disclosures of personal data. This is needed as a result of the changes to the interpretative effects on EU-derived legislation, such as the UK GDPR and other EU-derived elements of the UK’s data protection legislation, made by the EU (Withdrawal) Act 2018 (EUWA 2018) and the Retained EU law (Revocation and Reform) Act 2023.
	Subsection (2) inserts a new section 183A into the DPA 2018.
	New section 183A(1) sets out a presumption, in relation to any relevant enactments, or any rules of law, conferring powers or imposing duties relating to the processing of personal data, that requirements under the "main data protection legislation" are not overridden by such powers or duties.
	The "main data protection legislation", "relevant enactment" and "requirement" are defined in subsection (4) of new section 183A. Subsection (4) sets out which parts of the data protection legislation constitute the "main data protection legislation" for the purposes of new section 183A(1). It also defines "relevant enactment" for the purposes of subsection (1) as meaning any enactment so far as passed or made on or after the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force. This means that the presumption in subsection (1) does not apply to legislation passed or made before the day on which new section 183A comes into force. The reference to "enactment" includes devolved legislation (see section 205(1) of the DPA 2018).
	New section 183A(2)(a) ensures that subsection (1) does not apply to any provisions forming part of the "main data protection legislation". Subsection (2)(b) recognises that there may be situations where legislation is deliberately intended to override requirements of the data protection legislation and makes it clear that in such cases subsection (1) will not apply to the extent that the legislation makes express provision to this effect. This preserves the principle of parliamentary sovereignty. Whether or not devolved legislation is able to override the data protection legislation in this way will depend on the terms of the relevant devolution settlement.
	New section 183A(3) ensures that any duty or power in the legislation that makes provision for processing personal data can be taken into account for the purposes of determining whether it is possible to rely on any exception to a requirement in the data protection legislation. For example, if there is a duty in legislation on a person or organisation to disclose personal data, the requirement for a lawful basis in Article 6(1) of the UK GDPR is likely to be met. (Article 6(1)(c) provides a lawful basis for processing where the processing is necessary for compliance with a legal obligation to which the controller is subject).
	New section 183A(5) provides that the reference in subsection (1) to an enactment or rule of law that imposes a duty or confers a power to process personal data includes duties or powers that arise directly or indirectly, for example: provisions that remove restrictions, or provisions that authorise a person to require another person to process personal data.
	Subsection (3) of section 106 amends the DPA 2018 by inserting a new section 183B into the DPA 2018.
	New section 183B makes provision about the relationship between pre-commencement enactments which impose a duty, or confer a power, to process personal data and the main data protection legislation (see subsection (1)).
	The "main data protection legislation" and "requirement" are defined in subsection (5)(a) of new section 183B as having the same meaning as in new section 183A. Subsection (5)(b) defines "pre-commencement enactment" for the purposes of subsection (1) as meaning any enactment that has been passed or made before the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force. This limits the effect of subsection (1) to legislation passed or made before the day on which new section 18a3A comes into force. The reference to "enactment" includes devolved legislation (see section 205(1) of the DPA 2018).
	New section 183B(2) provides that the relationship described in new section 183B(1) is not changed by the removal of the principal of the supremacy of EU law in section 5(A1) of the EUWA 2018 nor the repeal of section 5(1) to (3) of that Act. These changes to the EUWA 2018 were made by section 3 of the Retained EU Law (Revocation and Reform) Act 2023. This will apply in cases in which the principle of supremacy of EU law was relevant to the relationship before 1 January 2024.
	New section 183B(3) provides that where the relevant provision of the main data protection legislation is a provision of, or made under, the UK GDPR, section 5(A2) of the EUWA 2018 does not apply to the relationship described in subsection (1). Section 5(A2) provides that provisions of assimilated direct legislation are subject to domestic enactments (so far as incompatible with them). The UK GDPR constitutes assimilated direct legislation and therefore falls within the scope of section 5(A2).
	New section 183B(4) states that nothing is to be implied about a relationship described in new section 183B(1) merely due to the fact that express provision with similar effect to section 183A(1) is made in connection with one relationship but not another.
	New section 183B(6) section 183B states that section 183A(5) applies for the purposes of subsection (1)(a) of new section 183B in the same manner that it applies for the purposes of section 183A(1). In other words, the reference in subsection (1) to an enactment or rule of law that imposes a duty or confers a power to process personal data includes duties or powers that arise directly or indirectly. For example, provisions that remove restrictions, or provisions that authorise a person to require another person to process personal data.
	Subsection (4) of section 106 makes some amendments to section 186 of the DPA 2018 to clarify its intended application and effect, particularly in light of new section 183A and new section 186A. For example, new section 186(2A)(c) reflects new section 183A(2)(b) by providing that the rule in section 186(1) does not apply to the extent that an enactment makes express provision to the contrary referring to section 186 itself or a provision listed in section 186(2). Whether or not devolved legislation is able to make such provision will depend on the terms of the relevant devolution settlement.
	Subsection (5) amends the DPA 2018 by inserting a new section 186A into the DPA 2018. New section 186A builds on section 186 DPA 2018 by making further provision in relation to the interaction between the data protection legislation and other existing legislative provisions or rules of law containing prohibitions or restrictions on the disclosure of information or authorising the withholding of information.
	New section 186A makes provision about the relationship between pre-commencement enactments which prohibit or restrict the disclosure of information or authorise the withholding of information and provisions of the UK GDPR or the DPA 2018 listed in section 186(2) (see subsection (1)).
	"Pre-commencement enactment" is defined in new section 186A(5) for the purposes of subsection (1) as meaning that any enactment that has been passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision of the data protection legislation listed in section 186(2) or (3). The reference to "enactment" includes devolved legislation.
	New section 186A(2) provides that the relationship described in subsection (1) is not changed by the removal of the principal of the supremacy of EU law in section 5(A1) of the EUWA 2018 nor the repeal of section 5(1) to (3) of that Act. These changes to the EUWA 2018 were made by section 3 of the Retained EU Law (Revocation and Reform) Act 2023. This will apply in cases in which the principle of supremacy of EU law was relevant to the relationship before 1 January 2024.
	New section 186A(3) provides that in relation to pre-commencement legislation, there may be occasions when an existing express or implied contrary indication means that section 186(1) does not apply.
	New section 186A(4) indicates that no inference should be drawn about the relationship described in new section 186A(1) merely due to the fact that express provision stating that section 186(1) applies is made in connection with one such relationship but not another.
	Subsection (6) of section 106 inserts a cross-reference to new section 183A and a signpost to new section 183B(3) into section 5(A3)(a) of the EUWA 2018, as inserted by section 3 of the Retained EU Law (Revocation and Reform) Act 2023. Section 5(A3) contains exceptions from the interpretation rule in section 5(A2) of the EUWA 2018, as also inserted by section 3 of the Retained EU Law (Revocation and Reform) Act 2023. That rule says that provisions of assimilated direct legislation (such as the UK GDPR) are subject to domestic enactments (so far as incompatible with them). The amendments have the effect that the rule is disapplied where new section 183A applies.
	Subsection (7) provides that subsections (3), (5) and (6)(c) of section 106 of the Data (Use and Access) Act 2025 are to be treated as having come into force on 1 January 2024. This means that those subsections will be treated as having had effect from the commencement of section 3 of the Retained EU Law (Revocation and Reform) Act 2023.
Part 5: Data Protection and Privacy Protection of prohibitions, restrictions and data subject’s rights Section 106: Protection of prohibitions, restrictions and data subject’s rights