Data Protection Act 2018
Sections and provisions with full text and the judgments that cite each one.
Section 121 — Data-sharing code
Data-sharing code 121 1 The Commissioner must prepare a code of practice which contains— a practical guidance in relation to the sharing of personal data in accordance with the requirements of the…
Section 122 — Direct marketing code
Direct marketing code 122 1 The Commissioner must prepare a code of practice which contains— a practical guidance in relation to the carrying out of direct marketing in accordance with the…
Section 123 — Age-appropriate design code
Age-appropriate design code 123 1 The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of…
Section 124 — Data protection and journalism code
Data protection and journalism code 124 1 The Commissioner must prepare a code of practice which contains— a practical guidance in relation to the processing of personal data for the purposes of…
Section 124A — Other codes of practice
Other codes of practice 124A 1 The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations…
Section 124B — Panels to consider codes of practice
Panels to consider codes of practice 124B 1 This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11). 2 The Commissioner must establish a…
Section 124C — Impact assessments for codes of practice
Impact assessments for codes of practice 124C 1 Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of— a who would be likely…
Section 125 — Approval of codes prepared under sections 121 to 124A
Approval of codes prepared under sections 121 to 124A 125 1 When a code is prepared under section 121, 122, 123 , 124 or 124A — a the Commissioner must submit the final version to the Secretary of…
Section 125A — Supply of contact details by HMRC
Supply of contact details by HMRC 125A 1 This subsection applies to contact details for— a a member of an ex-regular reserve force, or b a person to whom section 66 (officers and former servicemen…
Section 125B — Prohibition on disclosure of contact details supplied under section 125A
Prohibition on disclosure of contact details supplied under section 125A 125B 1 A person who receives information supplied under section 125A may not disclose it except with the consent of the…
Section 125C — Data protection
Data protection 125C 1 Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation. 2 In this section, “ the data protection legislation ”…
Section 126 — Publication and review of codes issued under section 125(4)
Publication and review of codes issued under section 125(4) 126 1 The Commissioner must publish a code issued under section 125(4). 2 Where an amendment of a code is issued under section 125(4), the…
Section 127 — Effect of codes issued under section 125(4)
Effect of codes issued under section 125(4) 127 1 A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal…
Section 128 — Other codes of practice
Other codes of practice 128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 129 — Consensual audits
Consensual audits 129 1 The Commissioner's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent of a controller or processor, to carry out an…
Section 130 — Records of national security certificates
Records of national security certificates 130 1 A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the certificate to the Commissioner. 2 If the…
Section 131 — Disclosure of information to the Commissioner
Disclosure of information to the Commissioner 131 1 No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commissioner with…
Section 132 — Confidentiality of information
Confidentiality of information 132 1 A person who is or has been the Commissioner, or a member of the Commissioner's staff or an agent of the Commissioner, must not disclose information which— a has…
Section 133 — Guidance about privileged communications
Guidance about privileged communications 133 1 The Commissioner must produce and publish guidance about— a how the Commissioner proposes to secure that privileged communications which the…
Section 134 — Fees for services
Fees for services 134 The Commissioner may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at the person's…
Section 135 — Manifestly unfounded or excessive requests by data subjects etc
Manifestly unfounded or excessive requests by data subjects etc 135 A1 This section makes provision about cases in which a request made to the Commissioner, to which the Commissioner is required or…
Section 136 — Guidance about fees
Guidance about fees 136 1 The Commissioner must produce and publish guidance about the fees the Commissioner proposes to charge in accordance with— a section 134 or 135, ... b . . . . . . . . . . . .…
Section 137 — Charges payable to the Commissioner by controllers
Charges payable to the Commissioner by controllers 137 1 The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commissioner. 2…
Section 138 — Regulations under section 137: supplementary
Regulations under section 137: supplementary 138 1 Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by…
Section 139 — Reporting to Parliament
Reporting to Parliament 139 1 The Commissioner must— a produce a general report on the carrying out of the Commissioner's functions annually, b arrange for it to be laid before Parliament, and c…
Section 139A — Analysis of performance
Analysis of performance 139A 1 The Commissioner must prepare and publish an analysis of the Commissioner’s performance using key performance indicators. 2 The analysis must be prepared and published…
Section 140 — Publication by the Commissioner
Publication by the Commissioner 140 A duty under this Act for the Commissioner to publish a document is a duty for the Commissioner to publish it, or to arrange for it to be published, in such form…
Section 141 — Notices from the Commissioner
Notices from the Commissioner 141 1 This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner. 2 The notice may be given to an…
Section 142 — Information notices
Information notices 142 1 The Commissioner may, by written notice (an “information notice”)— a require a controller or processor to provide the Commissioner with information that the Commissioner…
Section 143 — Information notices: restrictions
Information notices: restrictions 143 1 The Commissioner may not give an information notice with respect to the processing of personal data for the special purposes unless— a a determination under…
Section 144 — False statements made in response to information notices
False statements made in response to information notices 144 It is an offence for a person, in response to an information notice— a to make a statement which the person knows to be false in a…
Section 145 — Information orders
Information orders 145 1 This section applies if, on an application by the Commissioner, a court is satisfied that a person has failed to comply with a requirement of an information notice. 2 The…
Section 146 — Assessment notices
Assessment notices 146 1 The Commissioner may by written notice (an “assessment notice”) require a controller or processor to permit the Commissioner to carry out an assessment of whether the…
Section 146A — Assessment notices: approval of person to prepare report etc
Assessment notices: approval of person to prepare report etc 146A 1 This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to…
Section 147 — Assessment notices: restrictions
Assessment notices: restrictions 147 1 An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges…
Section 148 — Destroying or falsifying information and documents etc
Destroying or falsifying information and documents etc 148 1 This section applies where a person— a has been given an information notice requiring the person to provide the Commissioner with…
Section 148A — Interview notices
Interview notices 148A 1 This section applies where the Commissioner suspects that a controller or processor— a has failed or is failing as described in section 149(2), or b has committed or is…
Section 148B — Interview notices: restrictions
Interview notices: restrictions 148B 1 An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the…
Section 148C — False statements made in response to interview notices
False statements made in response to interview notices 148C It is an offence for an individual, in response to an interview notice— a to make a statement which the individual knows to be false in a…
Section 149 — Enforcement notices
Enforcement notices 149 1 Where the Commissioner is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) , (5) or (5A) , the Commissioner may give the person a…
Section 150 — Enforcement notices: supplementary
Enforcement notices: supplementary 150 1 An enforcement notice must— a state what the person has failed or is failing to do, and b give the Commissioner's reasons for reaching that opinion. 2 In…
Section 151 — Enforcement notices: rectification and erasure of personal data etc
Enforcement notices: rectification and erasure of personal data etc 151 1 Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor— a to…
Section 152 — Enforcement notices: restrictions
Enforcement notices: restrictions 152 1 The Commissioner may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data for…
Section 153 — Enforcement notices: cancellation and variation
Enforcement notices: cancellation and variation 153 1 The Commissioner may cancel or vary an enforcement notice by giving written notice to the person to whom it was given. 2 A person to whom an…
Section 153A — Withdrawal notices
Withdrawal notices 153A 1 The Commissioner may, by written notice (a “withdrawal notice”), withdraw the qualified status from a trust service provider, or the qualified status of a service provided…
Section 154 — Powers of entry and inspection
Powers of entry and inspection 154 Schedule 15 makes provision about powers of entry and inspection.
Section 155 — Penalty notices
Penalty notices 155 1 If the Commissioner is satisfied that a person— a has failed or is failing as described in section 149(2), (3), (4) , (5) or (5A) , ... b has failed to comply with an…
Section 156 — Penalty notices: restrictions
Penalty notices: restrictions 156 1 The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the…
Section 157 — Maximum amount of penalty
Maximum amount of penalty 157 1 In relation to an infringement of a provision of the UK GDPR , the maximum amount of the penalty that may be imposed by a penalty notice is— a the amount specified in…
Section 158 — Fixed penalties for non-compliance with charges regulations
Fixed penalties for non-compliance with charges regulations 158 1 The Commissioner must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations…