Skip to Main Content

Search
- Full Search
- Browse
- Legislation
- Help

ICLR.4
Case Genie
Products
Knowledge
Blog
About
Contact

Data Protection Act 2018

Log in

Powered by

legislation.gov.uk

Introduction

Introductory Text

CONTENTS |

PART 1—Preliminary
PART 2—General processing
- CHAPTER 1—Scope and definitions
  - 4Processing to which this Part applies
  - 5Definitions
- CHAPTER 2—The GDPR
  - Meaning of certain terms used in the GDPR
  - 6Meaning of “controller”
  - 7Meaning of “public authority” and “public body”
  - Lawfulness of processing
  - 8Lawfulness of processing: public interest etc
  - 9Child’s consent in relation to information society services
  - Special categories of personal data
  - 10Special categories of personal data and criminal convictions etc data
  - 11Special categories of personal data etc: supplementary
  - Rights of the data subject
  - 12Limits on fees that may be charged by controllers
  - 13Obligations of credit reference agencies
  - 14Automated decision-making authorised by law: safeguards
  - Restrictions on data subject's rights
  - 15Exemptions etc
  - 16Power to make further exemptions etc by regulations
  - Accreditation of certification providers
  - 17Accreditation of certification providers
  - Transfers of personal data to third countries etc
  - 18Transfers of personal data to third countries etc
  - Specific processing situations
  - 19Processing for archiving, research and statistical purposes: safeguards
  - Minor definition
  - 20Meaning of “court”
- CHAPTER 3—Other general processing
PART 3—Law enforcement processing
- CHAPTER 1—Scope and definitions
- CHAPTER 2—Principles
- CHAPTER 3—Rights of the data subject
  - Overview and scope
  - 43Overview and scope
  - Information: controller's general duties
  - 44Information: controller’s general duties
  - Data subject's right of access
  - 45Right of access by the data subject
  - Data subject's rights to rectification or erasure etc
  - 46Right to rectification
  - 47Right to erasure or restriction of processing
  - 48Rights under section 46 or 47: supplementary
  - Automated individual decision-making
  - 49Right not to be subject to automated decision-making
  - 50Automated decision-making authorised by law: safeguards
  - Supplementary
  - 51Exercise of rights through the Commissioner
  - 52Form of provision of information etc
  - 53Manifestly unfounded or excessive requests by the data subject
  - 54Meaning of “applicable time period”
- CHAPTER 4—Controller and processor
  - Overview and scope
  - 55Overview and scope
  - General obligations
  - 56General obligations of the controller
  - 57Data protection by design and default
  - 58Joint controllers
  - 59Processors
  - 60Processing under the authority of the controller or processor
  - 61Records of processing activities
  - 62Logging
  - 63Co-operation with the Commissioner
  - 64Data protection impact assessment
  - 65Prior consultation with the Commissioner
  - Obligations relating to security
  - 66Security of processing
  - Obligations relating to personal data breaches
  - 67Notification of a personal data breach to the Commissioner
  - 68Communication of a personal data breach to the data subject
  - Data protection officers
  - 69Designation of a data protection officer
  - 70Position of data protection officer
  - 71Tasks of data protection officer
- CHAPTER 5—Transfers of personal data to third countries etc
  - Overview and interpretation
  - 72Overview and interpretation
  - General principles for transfers
  - 73General principles for transfers of personal data
  - 74Transfers on the basis of an adequacy decision
  - 75Transfers on the basis of appropriate safeguards
  - 76Transfers on the basis of special circumstances
  - Transfers to particular recipients
  - 77Transfers of personal data to persons other than relevant authorities
  - Subsequent transfers
  - 78Subsequent transfers
- CHAPTER 6—Supplementary
PART 4—Intelligence services processing
PART 5—The Information Commissioner
- The Commissioner
- 114The Information Commissioner
- General functions
- 115General functions under the GDPR and safeguards
- 116Other general functions
- 117Competence in relation to courts etc
- International role
- 118Co-operation and mutual assistance
- 119Inspection of personal data in accordance with international obligations
- 120Further international role
- Codes of practice
- 121Data-sharing code
- 122Direct marketing code
- 123Age-appropriate design code
- 124Data protection and journalism code
- 125Approval of codes prepared under sections 121 to 124
- 126Publication and review of codes issued under section 125(4)
- 127Effect of codes issued under section 125(4)
- 128Other codes of practice
- Consensual audits
- 129Consensual audits
- Records of national security certificates
- 130Records of national security certificates
- Information provided to the Commissioner
- 131Disclosure of information to the Commissioner
- 132Confidentiality of information
- 133Guidance about privileged communications
- Fees
- 134Fees for services
- 135Manifestly unfounded or excessive requests by data subjects etc
- 136Guidance about fees
- Charges
- 137Charges payable to the Commissioner by controllers
- 138Regulations under section 137: supplementary
- Reports etc
- 139Reporting to Parliament
- 140Publication by the Commissioner
- 141Notices from the Commissioner
PART 6—Enforcement
- Information notices
- 142Information notices
- 143Information notices: restrictions
- 144False statements made in response to information notices
- 145Information orders
- Assessment notices
- 146Assessment notices
- 147Assessment notices: restrictions
- Information notices and assessment notices: destruction of documents etc
- 148Destroying or falsifying information and documents etc
- Enforcement notices
- 149Enforcement notices
- 150Enforcement notices: supplementary
- 151Enforcement notices: rectification and erasure of personal data etc
- 152Enforcement notices: restrictions
- 153Enforcement notices: cancellation and variation
- Powers of entry and inspection
- 154Powers of entry and inspection
- Penalties
- 155Penalty notices
- 156Penalty notices: restrictions
- 157Maximum amount of penalty
- 158Fixed penalties for non-compliance with charges regulations
- 159Amount of penalties: supplementary
- Guidance
- 160Guidance about regulatory action
- 161Approval of first guidance about regulatory action
- Appeals etc
- 162Rights of appeal
- 163Determination of appeals
- 164Applications in respect of urgent notices
- Complaints
- 165Complaints by data subjects
- 166Orders to progress complaints
- Remedies in the court
- 167Compliance orders
- 168Compensation for contravention of the GDPR
- 169Compensation for contravention of other data protection legislation
- Offences relating to personal data
- 170Unlawful obtaining etc of personal data
- 171Re-identification of de-identified personal data
- 172Re-identification: effectiveness testing conditions
- 173Alteration etc of personal data to prevent disclosure to data subject
- The special purposes
- 174The special purposes
- 175Provision of assistance in special purposes proceedings
- 176Staying special purposes proceedings
- 177Guidance about how to seek redress against media organisations
- 178Review of processing of personal data for the purposes of journalism
- 179Effectiveness of the media’s dispute resolution procedures
- Jurisdiction of courts
- 180Jurisdiction
- Definitions
- 181Interpretation of Part 6
PART 7—Supplementary and final provision
- Regulations under this Act
- 182Regulations and consultation
- Changes to the Data Protection Convention
- 183Power to reflect changes to the Data Protection Convention
- Rights of the data subject
- 184Prohibition of requirement to produce relevant records
- 185Avoidance of certain contractual terms relating to health records
- 186Data subject’s rights and other prohibitions and restrictions
- Representation of data subjects
- 187Representation of data subjects with their authority
- 188Representation of data subjects with their authority: collective proceedings
- 189Duty to review provision for representation of data subjects
- 190Post-review powers to make provision about representation of data subjects
- Framework for Data Processing by Government
- 191Framework for Data Processing by Government
- 192Approval of the Framework
- 193Publication and review of the Framework
- 194Effect of the Framework
- Data-sharing: HMRC and reserve forces
- 195Reserve forces: data-sharing by HMRC
- Offences
- 196Penalties for offences
- 197Prosecution
- 198Liability of directors etc
- 199Recordable offences
- 200Guidance about PACE codes of practice
- The Tribunal
- 201Disclosure of information to the Tribunal
- 202Proceedings in the First-tier Tribunal: contempt
- 203Tribunal Procedure Rules
- Interpretation
- 204Meaning of “health professional” and “social work professional”
- 205General interpretation
- 206Index of defined expressions
- Territorial application
- 207Territorial application of this Act
- General
- 208Children in Scotland
- 209Application to the Crown
- 210Application to Parliament
- 211Minor and consequential provision
- Final
- 212Commencement
- 213Transitional provision
- 214Extent
- 215Short title
SCHEDULE 1—Special categories of personal data and criminal convictions etc data
SCHEDULE 2—Exemptions etc from the GDPR
SCHEDULE 3—Exemptions etc from the GDPR: health, social work, education and child abuse data
SCHEDULE 4—Exemptions etc from the GDPR: disclosure prohibited or restricted by an enactment
SCHEDULE 5—Accreditation of certification providers: reviews and appeals
SCHEDULE 6—The applied GDPR and the applied Chapter 2
- PART 1—Modifications to the GDPR
- PART 2—Modifications to Chapter 2 of Part 2
SCHEDULE 7—Competent authorities
SCHEDULE 8—Conditions for sensitive processing under Part 3
SCHEDULE 9—Conditions for processing under Part 4
SCHEDULE 10—Conditions for sensitive processing under Part 4
SCHEDULE 11—Other exemptions under Part 4
SCHEDULE 12—The Information Commissioner
SCHEDULE 13—Other general functions of the Commissioner
SCHEDULE 14—Co-operation and mutual assistance
- PART 1—Law Enforcement Directive
- PART 2—Data Protection Convention
SCHEDULE 15—Powers of entry and inspection
SCHEDULE 16—Penalties
SCHEDULE 17—Review of processing of personal data for the purposes of journalism
SCHEDULE 18—Relevant records
SCHEDULE 19—Minor and consequential amendments
SCHEDULE 20—Transitional provision etc

Prepared for Unknown User by ICLR

Changes to legislation: This is the original version (as it was originally enacted).

2018 Chapter 12

[23rd May 2018]

Provisions

Show annotations

Show annotations

What version?

Versions available for this provision:

Latest available (revised)

08 Mar 2024

01 Jan 2024

31 Dec 2023

26 Dec 2023

01 Dec 2023

19 Jun 2023

05 May 2023

01 Feb 2023

25 Jan 2023

05 Dec 2022

30 Nov 2022

01 Nov 2022

30 Jul 2022

01 Jul 2022

06 Jun 2022

01 May 2022

18 Mar 2022

31 Jan 2022

17 Dec 2021

15 Dec 2021

28 Jan 2021

31 Dec 2020

01 Dec 2020

30 Sep 2020

14 Feb 2020

02 Dec 2019

16 Sep 2019

23 Jul 2019

21 Jul 2019

23 May 2019

29 Mar 2019

23 Jul 2018

25 May 2018

23 May 2018

Original (as enacted)

PDF / print options

The Incorporated Council of Law Reporting for England & Wales - Charity No.250605 Limited by Guarantee - Company Registered No.5034

Support | Contact Us | Terms & Conditions | Privacy

Subscription cancellation

To cancel your subscription, please click the Cancel subscription button below and we will process your request as soon as possible.

We use cookies on this website, you can read our Privacy and Cookies Policy. To use website as intended please Accept Cookies