Data Protection Act 2018
Sections and provisions with full text and the judgments that cite each one.
Section 1 — Overview
Overview 1 1 This Act makes provision about the processing of personal data. 2 Most processing of personal data is subject to the UK GDPR . 3 Part 2 supplements the UK GDPR . 4 Part 3 makes provision…
Section 2 — Protection of personal data
Protection of personal data 2 1 The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by— a requiring personal data to be processed lawfully and…
Section 3 — Terms relating to the processing of personal data
Terms relating to the processing of personal data 3 1 This section defines some terms used in this Act. 2 “ Personal data ” means any information relating to an identified or identifiable living…
Section 4 — Processing to which this Part applies
Processing to which this Part applies 4 1 This Part is relevant to most processing of personal data. 2 This Part — a applies to the types of processing of personal data to which the UK GDPR applies…
Section 5 — Definitions
Definitions 5 1 Terms used in ... this Part and in the UK GDPR have the same meaning in this Part as they have in the UK GDPR . 2 In subsection (1), the reference to a term's meaning in the UK GDPR…
Section 6 — Meaning of “controller”
Meaning of “controller” 6 1 The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to— a subsection (2), b section 209, and c section 210. 2 For the purposes of the UK…
Section 7 — Meaning of “public authority” and “public body”
Meaning of “public authority” and “public body” 7 1 For the purposes of the UK GDPR , the following (and only the following) are “public authorities” and “public bodies” ...— a a public authority as…
Section 8 — Lawfulness of processing: public interest etc
Lawfulness of processing: public interest etc 8 In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the…
Section 9 — Child's consent in relation to information society services
Child's consent in relation to information society services 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 9A — Processing in reliance on relevant international law
Processing in reliance on relevant international law 9A 1 Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation…
Section 10 — Special categories of personal data and criminal convictions etc data
Special categories of personal data and criminal convictions etc data 10 1 Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR…
Section 11 — Special categories of personal data etc: supplementary
Special categories of personal data etc: supplementary 11 1 For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the…
Section 12 — Limits on fees that may be charged by controllers
Limits on fees that may be charged by controllers 12 1 The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on— a Article 12(5) of the UK GDPR…
Section 13 — Obligations of credit reference agencies
Obligations of credit reference agencies 13 1 This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974). 2 The…
Section 13A — Meaning of “relevant offence” for purpose of right to erasure
Meaning of “relevant offence” for purpose of right to erasure 13A 1 The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR. 2 Regulations under this section are…
Section 14 — Automated decision-making authorised by law: safeguards
Automated decision-making authorised by law: safeguards 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 15 — Exemptions etc
Exemptions etc 15 1 Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR . 2 In Schedule 2— a Part 1 makes provision…
Section 16 — Power to make further exemptions etc by regulations
Power to make further exemptions etc by regulations 16 1 The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of…
Section 17 — Accreditation of certification providers
Accreditation of certification providers 17 1 Accreditation of a person as a certification provider is only valid when carried out by— a the Commissioner, or b the UK national accreditation body . 2…
Section 17A — Transfers based on adequacy regulations
Transfers based on adequacy regulations 17A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 17B — Transfers based on adequacy regulations: review etc
Transfers based on adequacy regulations: review etc 17B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 17C — Standard data protection clauses
Standard data protection clauses 17C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 18 — Transfers of personal data to third countries etc : public interest
Transfers of personal data to third countries etc : public interest 18 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 19 — Processing for archiving, research and statistical purposes: safeguards
Processing for archiving, research and statistical purposes: safeguards 19 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 20 — Meaning of “court”
Meaning of “court” 20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 21 — Definitions
Definitions 21 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 . . . . . . . . . . . . . . . . . . . . . . . . .…
Section 22 — Application of the GDPR to processing to which this Chapter applies
Application of the GDPR to processing to which this Chapter applies 22 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 23 — Power to make provision in consequence of regulations related to the GDPR
Power to make provision in consequence of regulations related to the GDPR 23 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 24 — Manual unstructured data held by FOI public authorities
Manual unstructured data held by FOI public authorities 24 1 The provisions of the UK GDPR and this Act listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue…
Section 25 — Manual unstructured data used in longstanding historical research
Manual unstructured data used in longstanding historical research 25 1 The provisions of the UK GDPR listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of…
Section 26 — National security and defence exemption
National security and defence exemption 26 1 A provision of the UK GDPR or this Act mentioned in subsection (2) does not apply to personal data to which the UK GDPR applies if exemption from the…
Section 27 — National security: certificate
National security: certificate 27 1 Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 26(2) is,…
Section 28 — National security and defence: modifications to Articles 9 and 32 of the UK GDPR
National security and defence: modifications to Articles 9 and 32 of the UK GDPR 28 1 Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) does not prohibit…
Section 29 — Processing to which this Part applies
Processing to which this Part applies 29 1 This Part applies to— a the processing by a competent authority of personal data wholly or partly by automated means, and b the processing by a competent…
Section 30 — Meaning of “competent authority”
Meaning of “competent authority” 30 1 In this Part, “ competent authority ” means— a a person specified or described in Schedule 7, and b any other person if and to the extent that the person has…
Section 31 — “The law enforcement purposes”
“The law enforcement purposes” 31 For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the…
Section 32 — Meaning of “controller” and “processor”
Meaning of “controller” and “processor” 32 1 In this Part, “ controller ” means the competent authority which, alone or jointly with others— a determines the purposes and means of the processing of…
Section 33 — Other definitions
Other definitions 33 1 This section defines certain other expressions used in this Part. 2 “ Employee ”, in relation to any person, includes an individual who holds a position (whether paid or…
Section 34 — Overview and general duty of controller
Overview and general duty of controller 34 1 This Chapter sets out the six data protection principles as follows— a section 35(1) sets out the first data protection principle (requirement that…
Section 35 — The first data protection principle
The first data protection principle 35 1 The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. 2 The processing…
Section 36 — The second data protection principle
The second data protection principle 36 1 The second data protection principle is that— a the law enforcement purpose for which personal data is collected (whether from the data subject or otherwise)…
Section 37 — The third data protection principle
The third data protection principle 37 The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in…
Section 38 — The fourth data protection principle
The fourth data protection principle 38 1 The fourth data protection principle is that— a personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept…
Section 39 — The fifth data protection principle
The fifth data protection principle 39 1 The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for…
Section 40 — The sixth data protection principle
The sixth data protection principle 40 The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures…
Section 41 — Safeguards: archiving
Safeguards: archiving 41 1 This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out — a for archiving purposes in the…
Section 42 — Safeguards: sensitive processing
Safeguards: sensitive processing 42 1 This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out…
Section 42A — Further provision about sensitive processing
Further provision about sensitive processing 42A 1 The Secretary of State may by regulations— a make provision so that an additional description of processing of personal data is sensitive processing…
Section 43 — Overview and scope
Overview and scope 43 1 This Chapter— a imposes general duties on the controller to make information available (see sections 44 and 45A ); b confers a right of access by the data subject (see…
Section 44 — ... Controller's general duties
... Controller's general duties 44 1 The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other…