Privacy and Data Protection Act 2014

An approved code of practice binds—

any organisation—

that sought approval of it; or

that consents to be bound by the approved code; and

any organisation that, by written notice given to the Information Commissioner, states that it intends to be bound by the approved code of practice as it is then in operation and that is capable of applying to the organisation.

A notice under subsection (1)(b) may indicate an intention that the organisation be bound by the approved code of practice—

generally; or

only in respect of specified information or a specified class of information collected, held, managed, used, disclosed or transferred by it; or

only in respect of any specified activity or class of activity.

A notice under subsection (1)(b) has no effect unless the Information Commissioner approves it.

The Information Commissioner may approve a notice under subsection (1)(b) if satisfied that the approved code of practice is capable of applying to the organisation to the extent set out in the notice.

An organisation is bound by an approved code of practice—

in the case of an organisation referred to in subsection (1)(a), on and after the coming into operation of the code; and

in the case of an organisation referred to in subsection (1)(b), on and after the later of—

the date stated in the notice as the date on and after which the organisation will be bound by the code; or

the date on which the organisation is notified of the Information Commissioner's approval of the notice.

An organisation bound by an approved code of practice may, by written notice given to the Information Commissioner, state that it intends to cease to be bound by that code.

An organisation ceases to be bound by an approved code of practice on and after the date of the notice under subsection (6) or any later date stated in that notice as the date on and after which the organisation will cease to be bound by the code.