Legalize / United Kingdom / Public General Act

Data Protection Act 2018

Type Public General Act

Publication 2018-05-23

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles 2

Reform history JSON API

(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b) make provision so that added processing is not sensitive processing for the purposes of this Part,

(c) make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and

(d) make provision varying such a condition as it relates to added processing.

(2) In subsection (1)—

“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

“protected condition in Schedule 8” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).

(3) Regulations under this section may amend this Part and sections 205 and 206.

(4) Regulations under this section are subject to the affirmative resolution procedure.

50A

(1) For the purposes of sections 50B and 50C—

(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

(b) a decision is a significant decision, in relation to a data subject, if—

(i) it produces an adverse legal effect for the data subject, or

(ii) it has a similarly significant adverse effect for the data subject.

(2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

50B

(1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.

(2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

(3) The second condition is that the decision is required or authorised by law.

50C

(1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—

(a) based entirely or partly on personal data, and

(b) based solely on automated processing,

the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).

(2) The safeguards must consist of or include measures which—

(a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;

(b) enable the data subject to make representations about such decisions;

(d) enable the data subject to contest such decisions.

(3) Subsections (1) and (2) do not apply in relation to a significant decision if—

(a) exemption from those provisions is required for a reason listed in subsection (4),

(b) the controller reconsiders the decision as soon as reasonably practicable, and

(4) Those reasons are—

(a) to avoid obstructing an official or legal inquiry, investigation or procedure;

(b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(d) to safeguard national security;

(e) to protect the rights and freedoms of others.

(5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.

50D

(1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.

(2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.

(3) Regulations under subsection (1) or (2) may amend section 50A.

(4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—

(a) provision requiring the safeguards to include measures in addition to those described in section 50C(2),

(b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and

(c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).

(5) Regulations under this section are subject to the affirmative resolution procedure.

74AA

(1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—

(a) a third country, or

(b) an international organisation.

(2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).

(3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.

(4) Regulations under this section may, among other things—

(a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;

(b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

(i) a sector or geographic area within a third country,

(ii) the controller or processor,

(iii) the recipient of the personal data,

(iv) the personal data transferred,

(v) the means by which the transfer is made, or

(vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(d) confer a discretion on a person.

(5) Regulations under this section are subject to the negative resolution procedure.

74AB

(1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as relevant to law enforcement processing.

(2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—

(a) respect for the rule of law and for human rights in the country or by the organisation,

(b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

(d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

(e) relevant international obligations of the country or organisation, and

(f) the constitution, traditions and culture of the country or organisation.

(3) In subsections (1) and (2)—

(a) the references to the protection provided for data subjects are to that protection taken as a whole,

(b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and

(c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).

(4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—

(a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

(b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.

91A

(1) The Secretary of State may by regulations—

(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b) make provision so that added processing is not sensitive processing for the purposes of this Part,

(c) make provision so that a protected condition in Schedule 10 may or may not be relied on in connection with added processing, and

(d) make provision varying such a condition as it relates to added processing.

(2) In subsection (1)—

“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

“protected condition in Schedule 10” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).

(3) Regulations under this section may amend this Part and sections 205 and 206.

(4) Regulations under this section are subject to the affirmative resolution procedure.

124A

(1) The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.

(2) Regulations under this section—

(a) must describe the personal data or processing to which the code of practice is to relate, and

(b) may describe the persons or classes of person to whom it is to relate.

(3) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(4) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(5) A code under this section may include transitional provision or savings.

(6) Regulations under this section are subject to the negative resolution procedure.

(7) In this section—

“good practice in the processing of personal data” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;

“trade association” includes a body representing controllers or processors.

124B

(1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11).

(2) The Commissioner must establish a panel of individuals to consider the code.

(3) The panel must consist of—

(a) individuals the Commissioner considers have expertise in the subject matter of the code, and

(b) individuals the Commissioner considers—

(i) are likely to be affected by the code, or

(ii) represent persons likely to be affected by the code.

(4) Before the panel begins to consider the code, the Commissioner must—

(a) publish the code in draft, and

(b) publish a statement that—

(i) states that a panel has been established to consider the code,

(ii) identifies the members of the panel,

(iii) explains the process by which they were selected, and

(iv) explains the reasons for their selection.

(5) Where at any time it appears to the Commissioner that a member of the panel is not willing or able to serve as a member of the panel, the Commissioner may select another individual to be a member of the panel.

(6) Where the Commissioner selects an individual to be a member of the panel under subsection (5), the Commissioner must publish a statement that—

(a) identifies the member of the panel,

(b) explains the process by which the member was selected, and

(7) The Commissioner must make arrangements—

(a) for the members of the panel to consider the code with one another (whether in person or otherwise), and

(b) for the panel to prepare and submit to the Commissioner a report on the code within such reasonable period as is determined by the Commissioner.

(8) If the panel submits to the Commissioner a report on the code within the period determined by the Commissioner, the Commissioner must as soon as reasonably practicable—

(a) make any alterations to the code that the Commissioner considers appropriate in the light of the report, and

(b) publish—

(i) the code in draft,

(ii) the report or a summary of it, and

(iii) in a case where a recommendation in the report to alter the code has not been accepted by the Commissioner, an explanation of why it has not been accepted.

(9) The Commissioner may pay remuneration and expenses to the members of the panel.

(10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11).

(11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of—

(a) a code prepared under section 124A, or

(b) an amendment of such a code,

that is specified or described in the regulations.

(12) Regulations under this section are subject to the negative resolution procedure.

124C

(1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of—

(a) who would be likely to be affected by the code, and

(b) the effect the code would be likely to have on them.

(2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.

164A

(1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.

(2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.

(3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.

(4) If a controller receives a complaint under this section, the controller must without undue delay—

(a) take appropriate steps to respond to the complaint, and

(b) inform the complainant of the outcome of the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—

(a) making enquiries into the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint.

164B

(1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.

(2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.

(3) Regulations under this section may include—

(a) provision about a matter listed in subsection (4), or

(b) provision conferring power on the Commissioner to determine those matters.

(4) The matters are—

(a) the form and manner in which a notification must be made,

(b) the time at which, or period within which, a notification must be made, and

(5) Regulations under this section are subject to the negative resolution procedure.

Schedule 12A

Number of members

1

(1) The Commission is not to be regarded—

(a) as a servant or agent of the Crown, or

(b) as enjoying any status, immunity or privilege of the Crown.

(2) The Commission’s property is not to be regarded—

(a) as property of the Crown, or

(b) as property held on behalf of the Crown.

2

(1) The number of members of the Commission is to be determined by the Secretary of State.

(2) That number must not be—

(a) less than 3, or

(b) more than 14.

(3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b).

(4) Regulations under this paragraph are subject to the negative resolution procedure.

3

(1) The Commission is to consist of—

(a) the non-executive members, and

(b) the executive members.

(2) The non-executive members are—

(a) a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and

(b) such other members as the Secretary of State may appoint.

(3) The executive members are—

(a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and

(b) such other members, if any, as the non-executive members may appoint.

(4) The Secretary of State must consult the chair of the Commission before appointing a non-executive member.

(5) The non-executive members must consult the Secretary of State before appointing the chief executive.

(6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be.

(7) The Secretary of State may by direction set a maximum and a minimum number of executive members.

(8) The Commission may appoint one of the non-executive members as a deputy to the chair.

4

The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.

5

(1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition.

(2) A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition.

6

(1) Before—

(a) recommending a person for appointment as the chair of the Commission, or

(b) appointing a person as a non-executive member of the Commission,

the Secretary of State must be satisfied that the person does not have a conflict of interest.

(2) The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest.

(3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest.

(4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State.

(5) In this Schedule, “conflict of interest”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission.

7

(1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph.

(2) The chair must be appointed for a term of not more than 7 years.

(3) On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years.

(4) A person cannot be appointed as the chair more than once.

(5) The chair may be relieved from office by His Majesty at the chair’s own request.

(6) The chair may be removed from office by His Majesty on an Address from both Houses of Parliament.

(7) No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that—

(a) the chair is guilty of serious misconduct,

(b) the chair has a conflict of interest (see paragraph 6(5)),

(d) the chair is unable, unfit or unwilling to carry out the chair’s functions.

8

(1) A deputy chair of the Commission may resign that office by giving written notice to the Commission.

(2) A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission.

(3) A deputy chair of the Commission may be removed from that office by the Commission.

9

(1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State.

(2) The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph.

(3) The member must be appointed for a term of not more than 7 years.

(4) The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years.

(5) The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion.

(6) The member may resign from office by giving written notice to the Secretary of State and the Commission.

(7) The Secretary of State may remove the member from office by written notice if satisfied that—

(a) the member is guilty of serious misconduct,

(b) the member has a conflict of interest (see paragraph 6(5)),

(d) the member is unable, unfit or unwilling to carry out the member’s functions.

(8) At the time of removing the member from office the Secretary of State must make public the decision to do so.

(9) The Secretary of State must—

(a) give the member a statement of reasons for the removal, and

(b) if asked to do so by the member, publish the statement.

10

(1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine.

(2) The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine.

(3) The Commission may make a payment to a person of such amount as the Secretary of State may determine where—

(a) the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and

(b) it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation.

11

(1) The executive members of the Commission are to be employees of the Commission.

(2) The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine.

(3) The Commission must—

(a) pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and

(b) provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine.

12

(1) The Commission may—

(a) appoint other employees, and

(b) make such other arrangements for the staffing of the Commission as it considers appropriate.

(2) In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition.

(3) Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine.

(4) The Commission may—

(a) pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and

(b) provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine.

13

(1) The Commission may establish committees.

(2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission.

(3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission.

(4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine.

14

(1) The Commission may delegate any of its functions to—

(a) a member of the Commission,

(b) an employee of the Commission, or

(2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines.

(3) A committee of the Commission may delegate any function delegated to it to a member of the committee.

(4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines.

(5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do.

(6) The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function.

15

The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.

16

(1) The Commission may make arrangements for regulating—

(a) its own procedure, and

(b) the procedure of a committee of the Commission.

(2) The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule.

(3) Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority.

(4) The Commission must publish arrangements which it makes under this paragraph.

(5) This paragraph is subject to paragraph 18.

17

The Commission must make arrangements for the keeping of proper records of—

(a) its proceedings,

(b) the proceedings of a committee of the Commission,

(d) anything done by a member or employee of the Commission under paragraph 14(1), and

(e) anything done by a member of a committee of the Commission under paragraph 14(3).

18

(1) This paragraph applies if—

(a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission,

(b) a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or

(c) a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee.

(2) The member with the interest must declare it.

(3) The declaration must be recorded in the minutes of the meeting.

(4) The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless—

(a) in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded,

(b) in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or

(c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded.

(5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution—

(a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and

(b) is not less than its quorum.

(6) For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person—

(a) is a member of a company or firm, and

(b) is to be regarded as interested in any matter involving that company or firm,

is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.

(7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that—

(a) a person is a member of a company or firm, and

(b) is to be regarded as interested in any matter involving that company or firm,

is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.

(8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn.

(9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting—

(a) is not required to attend the meeting, but

(b) is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question.

19

(1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by—

(a) a vacancy in the membership of the Commission or of the committee,

(b) a defect in the appointment of a member of the Commission,

(d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18.

(2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c).

20

The Secretary of State may make payments to the Commission.

21

(1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State.

(2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs.

(3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund.

22

(1) The Commission must keep proper accounts and proper records in relation to them.

(2) The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State.

(3) The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates.

(4) The Comptroller and Auditor General must—

(a) examine, certify and report on the statement of accounts, and

(b) send a copy of the certified statement and the report to the Secretary of State.

(5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b).

(6) In this paragraph “financial year” means—

(a) the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and

(b) each successive period of 12 months.

23

(1) The application of the Commission’s seal must be authenticated by the signature of—

(a) the chair of the Commission, or

(b) another person authorised for that purpose by the Commission.

(2) A document purporting to be duly executed under the Commission’s seal or signed on its behalf—

(a) is to be received in evidence, and

(b) is to be taken to be executed or signed in that way, unless the contrary is shown.

(3) This paragraph does not extend to Scotland.

24

The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.

25

(1) The first chief executive of the Commission is to be appointed by the chair of the Commission.

(2) Before making the appointment the chair must consult the Secretary of State.

(3) The appointment must be for a term of not more than 2 years.

(4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years.

(5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”.

(6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).

(7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4).

26

In this Schedule—

(a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and

(b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.

The applied GPDR

40A

(1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.

(2) The controller must be able to demonstrate that the data subject consented to the processing.

(3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—

(a) in a manner which clearly distinguishes the request from the other matters,

(b) in an intelligible and easily accessible form, and

(4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.

(5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).

(6) Processing may only be carried out in reliance on consent if—

(a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and

(b) it is as easy for the data subject to withdraw the consent as to give it.

(7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.

141A

(1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.

(2) The notice may be given to the person by—

(a) delivering it by hand to a relevant individual,

(b) leaving it at the person’s proper address,

(d) sending it by email to the person’s email address.

(3) A “relevant individual” means—

(a) in the case of a notice to an individual, that individual;

(b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;

(c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;

(d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.

(4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—

(a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;

(b) in any other case, the address determined in accordance with subsection (5).

(5) The address is—

(a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;

(b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;

(c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person.

(6) A person’s email address is—

(a) an email address published for the time being by that person as an address for contacting that person, or

(b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person.

(7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.

(8) In this section, “officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.

(9) This section does not limit other lawful means of giving a notice.

45A

(1) Sections 44(2) and 45(1) do not require the controller to give the data subject—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

(2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

(a) the decision to rely on the exemption,

(b) the reason for the decision,

(d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and

(e) the data subject’s right to apply to a court under section 167.

(3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

(a) undermine a claim described in subsection (1)(a), or

(b) conflict with a duty described in subsection (1)(b).

(4) The controller must—

(a) record the reason for a decision to rely on the exemption in subsection (1), and

(b) if requested to do so by the Commissioner, make the record available to the Commissioner.

(5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).

Codes of conduct

71A

(1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.

(2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.

(3) For the purposes of this section—

(a) “public body” means a body or other person whose functions are, or include, functions of a public nature, and

(b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).

(4) A code of conduct described in subsection (1) may, for example, make provision with regard to—

(a) lawful and fair processing;

(b) the collection of personal data;

(d) the exercise of the rights of data subjects;

(e) the measures and procedures referred to in sections 56, 57 and 62;

(f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;

(g) the transfer of personal data to third countries or international organisations;

(h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.

(5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.

(6) Where an expert public body does so, the Commissioner must—

(a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part,

(b) decide whether to approve the code, and

(7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.

78A

(1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

(2) The provisions are—

(a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);

(b) Chapter 3 of this Part (rights of the data subject);

(i) section 67 (notification of personal data breach to the Commissioner);

(ii) section 68 (communication of personal data breach to the data subject);

(d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);

(e) in Part 5—

(i) section 119 (inspection in accordance with international obligations);

(ia) section 119A (standard clauses for transfers to third countries);

(ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;

(f) in Part 6—

(i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);

(ii) sections 170 to 173 (offences relating to personal data);

(g) in Part 7, section 187 (representation of data subjects).

(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

(a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;

(b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);

(d) Schedule 8 (conditions for sensitive processing).

(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

(a) the following provisions of section 73—

(i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);

(ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);

(b) section 78 (subsequent transfers).

82A

(1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—

(a) an application for designation of the processing is made in accordance with this section, and

(b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.

(2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.

(3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—

(a) a country or territory outside the United Kingdom, or

(b) an international organisation.

(4) A designation notice must—

(a) specify or describe the processing and qualifying competent authority that are designated, and

(b) be given to the applicants for the designation (and see also section 82D).

(5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—

(a) the qualifying competent authority, and

(b) the intelligence service with which the processing is to be carried out.

(6) An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.

(7) The application must—

(a) describe the processing, including the intended purposes and means of processing, and

(b) explain why the applicants consider that designation is required for the purposes of safeguarding national security.

(8) Before giving a designation notice, the Secretary of State must consult the Commissioner.

(9) In this section, “joint controller”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.

82B

(1) A designation notice must state when it comes into force.

(2) A designation notice ceases to be in force at the earliest of the following times—

(a) at the end of the period of 5 years beginning when the notice comes into force;

(b) (if relevant) at the end of a shorter period specified in the notice;

(3) The Secretary of State may give a further designation notice in respect of processing that is, or has been, the subject of a previous designation notice.

82C

(1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force.

(2) A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security.

(3) A person who applied for the designation of the processing must, on a request from the Secretary of State, provide—

(a) a description of the processing that is being, or is intended to be, carried out in reliance on the notice, and

(b) an explanation of why the person considers that designation of the processing continues to be required for the purposes of safeguarding national security.

(4) The Secretary of State must at least annually—

(a) review each designation notice that is for the time being in force, and

(b) consider whether designation of the processing which is the subject of the notice continues to be required for the purposes of safeguarding national security.

(5) The Secretary of State—

(a) may withdraw a designation notice by giving a further notice (a “withdrawal notice”) to the persons who applied for the designation, and

(b) must give a withdrawal notice if the Secretary of State considers that designation of some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security (whether as a result of a review required under subsection (4) or otherwise).

(6) A withdrawal notice must—

(a) withdraw the designation notice completely, and

(b) state when it comes into force.

(7) In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider—

(a) the desirability of the processing ceasing to be designated as soon as possible, and

(b) where relevant, the time needed to effect an orderly transition to new arrangements for the processing of personal data.

82D

(1) Where the Secretary of State gives a designation notice—

(a) the Secretary of State must send a copy of the notice to the Commissioner, and

(b) the Commissioner must publish a record of the notice.

(2) The record must contain—

(a) the Secretary of State’s name,

(b) the date on which the notice was given,

(d) subject to subsection (3), the rest of the text of the notice.

(3) The Commissioner must not publish the text, or a part of the text, of the notice if—

(a) the Secretary of State has determined that publishing the text or that part of the text—

(i) would be against the interests of national security,

(ii) would be contrary to the public interest, or

(iii) might jeopardise the safety of any person, and

(b) the Secretary of State has notified the Commissioner of that determination.

(4) The Commissioner must keep the record of the notice available to the public while the notice is in force.

(5) Where the Secretary of State gives a withdrawal notice, the Secretary of State must send a copy of the notice to the Commissioner.

82E

(1) A person directly affected by a designation notice may appeal to the Tribunal against the notice.

(2) If, on an appeal under this section, the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Secretary of State did not have reasonable grounds for giving the notice, the Tribunal may—

(a) allow the appeal, and

(b) quash the notice.

The Information Commission

114A

(1) A body corporate called the Information Commission is established.

(2) Schedule 12A makes further provision about the Commission.

Duties in carrying out functions

120A

It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation—

(a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and

(b) to promote public trust and confidence in the processing of personal data.

120B

In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances—

(a) the desirability of promoting innovation;

(b) the desirability of promoting competition;

(d) the need to safeguard public security and national security;

(e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.

120C

(1) The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under—

(a) sections 120A and 120B,

(b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and

(2) The Commissioner must—

(a) review the strategy from time to time, and

(b) revise the strategy as appropriate.

(3) The Commissioner must publish the strategy and any revised strategy.

120D

(1) The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition.

(2) The persons are—

(a) such persons exercising regulatory functions as the Commissioner considers appropriate;

(b) such other persons as the Commissioner considers appropriate.

(3) In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015.

139A

(1) The Commissioner must prepare and publish an analysis of the Commissioner’s performance using key performance indicators.

(2) The analysis must be prepared and published at least annually.

(3) In this section, “key performance indicators” means factors by reference to which the Commissioner’s performance can be measured most effectively.

Documents and notices

161A

(1) The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5).

(2) The report must include the following information about UK GDPR investigations—

(a) the number of investigations begun, continued or completed by the Commissioner during the reporting period,

(b) the different types of act and omission that were the subject matter of the investigations,

(d) the duration of investigations that ended in the reporting period, and

(e) the different types of outcome in investigations that ended in that period.

(3) The report must include information about the enforcement powers exercised by the Commissioner in the reporting period in connection with—

(a) processing of personal data by a competent authority for any of the law enforcement purposes, and

(b) processing of personal data to which Part 4 applies.

(4) The information included in the report in accordance with subsections (2) and (3) must include information about—

(a) the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and

(b) the reasons why that happened.

(5) The report must include a review of how the Commissioner had regard to the guidance published under section 160 when exercising the Commissioner’s enforcement powers as described in subsections (2)(c) and (3).

(6) In this section—

“enforcement powers” means the powers under—Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,sections 142 to 159 of this Act,paragraph 2(a), (b) and (c) of Schedule 13 to this Act, andSchedules 15 and 16 to this Act;

“the law enforcement purposes” has the meaning given in section 31 of this Act;

“the reporting period” means the period to which the report relates;

“UK GDPR investigation” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).

180A

(1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—

(a) Article 15 of the UK GDPR (right of access by the data subject);

(b) Article 20 of the UK GDPR (right to data portability);

(d) section 94 of this Act (intelligence services processing: right of access by the data subject).

(2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.

(3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.

(4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.

Prohibitions and restrictions etc on processing

183A

(1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.

(2) Subsection (1) does not apply—

(a) to a relevant enactment forming part of the main data protection legislation, or

(b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).

(3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.

(4) In this section—

“the main data protection legislation” means the data protection legislation other than provision of or made under—Chapter 6 or 8 of the UK GDPR, orParts 5 to 7 of this Act;

“relevant enactment” means an enactment so far as passed or made on or after 20th August 2025;

“requirement” includes a prohibition or restriction.

(5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—

(a) by authorising one person to require another person to process personal data, or

(b) by removing restrictions on processing personal data,

and the references in subsection (3) to a duty or power are to be read accordingly.

Schedule A1

This condition is met where the processing is necessary for the purposes of responding to a request made in accordance with the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime, signed on 3 October 2019.

57

The Border Security Commander.

146A

(1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report.

(2) The controller or processor must, within such period as is specified in the assessment notice, nominate to the Commissioner a person to prepare the report.

(3) If the Commissioner is satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor approve the nominated person to prepare the report.

(4) If the Commissioner is not satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor—

(a) inform the controller or processor that the Commissioner has decided not to approve the nominated person to prepare the report,

(b) inform the controller or processor of the reasons for that decision, and

(5) If the controller or processor does not nominate a person within the period specified in the assessment notice, the Commissioner must by written notice to the controller or processor approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.

(6) It is the duty of the controller or processor to give the person approved to prepare the report all such assistance as the person may reasonably require to prepare the report.

Interview notices

148A

(1) This section applies where the Commissioner suspects that a controller or processor—

(a) has failed or is failing as described in section 149(2), or

(b) has committed or is committing an offence under this Act.

(2) For the purpose of investigating the suspected failure or offence, the Commissioner may, by written notice (an “interview notice”), require an individual within subsection (3) to—

(a) attend at a place specified in the notice, and

(b) answer questions with respect to any matter relevant to the investigation.

(3) An individual is within this subsection if the individual—

(a) is the controller or processor,

(b) is or was at any time employed by, or otherwise working for, the controller or processor, or

(4) An interview notice must specify the time at which the individual must attend at the specified place and answer questions (but see the restrictions in subsections (6) and (7)).

(5) An interview notice must—

(a) indicate the nature of the suspected failure or offence that is the subject of the investigation,

(b) provide information about the consequences of failure to comply with the notice, and

(6) An interview notice may not require an individual to attend at the specified place and answer questions before the end of the period within which an appeal can be brought against the notice.

(7) If an appeal is brought against an interview notice, the individual to whom the notice is given need not attend at the specified place and answer questions pending the determination or withdrawal of the appeal.

(8) If an interview notice—

(a) states that, in the Commissioner’s opinion, it is necessary for the individual to attend at the specified place and answer questions urgently, and

(b) gives the Commissioner’s reasons for reaching that opinion,

subsections (6) and (7) do not apply but the notice must not require the individual to attend at the specified place and answer questions before the end of the period of 24 hours beginning when the notice is given.

(9) The Commissioner may cancel or vary an interview notice by written notice to the individual to whom it was given.

148B

(1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

(2) An interview notice does not require an individual to answer questions in respect of a communication which is made—

(a) between a professional legal adviser and the adviser’s client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(3) An interview notice does not require an individual to answer questions in respect of a communication which is made—

(a) between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(4) In subsections (2) and (3), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(5) An interview notice does not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence.

(6) The reference to an offence in subsection (5) does not include an offence under—

(a) this Act;

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(7) A statement made by an individual in response to an interview notice may not be used in evidence against that individual on a prosecution for an offence under this Act (other than an offence under section 148C) unless in the proceedings—

(a) in giving evidence the individual provides information inconsistent with the statement, and

(b) evidence relating to the statement is adduced, or a question relating to it is asked, by that individual or on that individual’s behalf.

(8) The Commissioner may not give an interview notice with respect to the processing of personal data for the special purposes.

(9) The Commissioner may not give an interview notice to an individual for the purpose of investigating a suspected failure or offence if the controller or processor suspected of the failure or offence is a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters).

148C

It is an offence for an individual, in response to an interview notice—

(a) to make a statement which the individual knows to be false in a material respect, or

(b) recklessly to make a statement which is false in a material respect.

Interview notices

3A

(1) Sub-paragraph (2) applies where the Commissioner gives an interview notice to an individual during a relevant period.

(2) If the interview notice—

(a) states that, in the Commissioner’s opinion, it is necessary for the individual to comply with a requirement in the notice for the purposes of the relevant review, and

(b) gives the Commissioner’s reasons for reaching that opinion,

subsections (6) and (7) of section 148A do not apply but the notice must not require the individual to comply with the requirement before the end of the period of 24 hours beginning when the notice is given.

(3) During a relevant period, section 148B has effect as if for subsection (8) there were substituted—

(8) The Commissioner may not give an individual an interview notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.

13A

(1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.

(2) Regulations under this section are subject to the affirmative resolution procedure.

The applied GPDR

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.

Data Protection Act 2018

50A

50B

50C

50D

74AA

74AB

91A

124A

124B

124C

164A

164B

Schedule 12A

Number of members

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

The applied GPDR

GDPR: right to an effective remedy against the Commissioner

40A

141A

45A

Codes of conduct

71A

78A

82A

82B

82C

82D

82E

The Information Commission

114A

Duties in carrying out functions

120A

120B

120C

120D

139A

Documents and notices

161A

180A

Prohibitions and restrictions etc on processing

183A

Schedule A1

57

146A

Interview notices

148A

148B

148C

Interview notices

3A

13A

The applied GPDR

GDPR: right to an effective remedy against the Commissioner