Data Protection Act 2018
Sections and provisions with full text and the judgments that cite each one.
Section 159 — Amount of penalties: supplementary
Amount of penalties: supplementary 159 1 For the purposes of Article 83 of the UK GDPR and section 157, the Secretary of State may by regulations— a provide that a person of a description specified…
Section 160 — Guidance about regulatory action
Guidance about regulatory action 160 1 The Commissioner must produce and publish guidance about how the Commissioner proposes to exercise the Commissioner's functions in connection with— a…
Section 161 — Approval of first guidance about regulatory action
Approval of first guidance about regulatory action 161 1 When the first guidance is produced under section 160(1)— a the Commissioner must submit the final version to the Secretary of State, and b…
Section 161A — Annual report on regulatory action
Annual report on regulatory action 161A 1 The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5). 2 The report must include the…
Section 162 — Rights of appeal
Rights of appeal 162 1 A person who is given any of the following notices may appeal to the Tribunal— a an information notice; b an assessment notice; ba an interview notice; c an enforcement notice;…
Section 163 — Determination of appeals
Determination of appeals 163 1 Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3). 2 The Tribunal may review any determination of fact on which the notice…
Section 164 — Applications in respect of urgent notices
Applications in respect of urgent notices 164 1 This section applies where an information notice, an assessment notice , an interview notice or an enforcement notice given to a person contains an…
Section 164A — Complaints by data subjects to controllers
Complaints by data subjects to controllers 164A 1 A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data…
Section 164B — Controllers to notify the Commissioner of the number of complaints
Controllers to notify the Commissioner of the number of complaints 164B 1 The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to…
Section 165 — Complaints by data subjects to the Commissioner
Complaints by data subjects to the Commissioner 165 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 A data subject may make a complaint to the Commissioner if the data subject…
Section 166 — Orders to progress complaints to the Commissioner
Orders to progress complaints to the Commissioner 166 1 This section applies where, after a data subject makes a complaint under section 165 ..., the Commissioner— a fails to take appropriate steps…
Section 167 — Compliance orders
Compliance orders 167 1 This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection…
Section 168 — Compensation for contravention of the UK GDPR
Compensation for contravention of the UK GDPR 168 1 In Article 82 of the UK GDPR (right to compensation for material or non-material damage), “ non-material damage ” includes distress. 2 Subsection…
Section 169 — Compensation for contravention of other data protection legislation
Compensation for contravention of other data protection legislation 169 1 A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the…
Section 170 — Unlawful obtaining etc of personal data
Unlawful obtaining etc of personal data 170 1 It is an offence for a person knowingly or recklessly— a to obtain or disclose personal data without the consent of the controller, b to procure the…
Section 171 — Re-identification of de-identified personal data
Re-identification of de-identified personal data 171 1 It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the…
Section 172 — Re-identification: effectiveness testing conditions
Re-identification: effectiveness testing conditions 172 1 For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “ the…
Section 173 — Alteration etc of personal data to prevent disclosure to data subject
Alteration etc of personal data to prevent disclosure to data subject 173 1 Subsection (3) applies where— a a request has been made in exercise of a data subject access right, and b the person making…
Section 174 — The special purposes
The special purposes 174 1 In this Part, “ the special purposes ” means one or more of the following— a the purposes of journalism; b academic purposes; c artistic purposes; d literary purposes. 2 In…
Section 175 — Provision of assistance in special purposes proceedings
Provision of assistance in special purposes proceedings 175 1 An individual who is a party, or prospective party, to special purposes proceedings may apply to the Commissioner for assistance in those…
Section 176 — Staying special purposes proceedings
Staying special purposes proceedings 176 1 In any special purposes proceedings before a court, if the controller or processor claims, or it appears to the court, that any personal data to which the…
Section 177 — Guidance about how to seek redress against media organisations
Guidance about how to seek redress against media organisations 177 1 The Commissioner must produce and publish guidance about the steps that may be taken where an individual considers that a media…
Section 178 — Review of processing of personal data for the purposes of journalism
Review of processing of personal data for the purposes of journalism 178 1 The Commissioner must— a review the extent to which, during each review period, the processing of personal data for the…
Section 179 — Effectiveness of the media's dispute resolution procedures
Effectiveness of the media's dispute resolution procedures 179 1 The Secretary of State must, before the end of each review period, lay before Parliament a report produced by the Secretary of State…
Section 180 — Jurisdiction
Jurisdiction 180 1 The jurisdiction conferred on a court by the provisions listed in subsection (2) is exercisable— a in England and Wales, by the High Court or the county court, b in Northern…
Section 180A — Procedure in connection with subject access requests
Procedure in connection with subject access requests 180A 1 This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under— a…
Section 181 — Interpretation of Part 6
Interpretation of Part 6 181 In this Part— “ assessment notice ” has the meaning given in section 146; “ certification provider ” has the meaning given in section 17; “ enforcement notice ” has the…
Section 182 — Regulations and consultation
Regulations and consultation 182 1 Regulations under this Act are to be made by statutory instrument. 2 Before making regulations under this Act, the Secretary of State must consult— a the…
Section 183 — Power to reflect changes to the Data Protection Convention
Power to reflect changes to the Data Protection Convention 183 1 The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in…
Section 183A — Protection of prohibitions and restrictions etc on processing: relevant enactments
Protection of prohibitions and restrictions etc on processing: relevant enactments 183A 1 A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does…
Section 183B — Protection of prohibitions and restrictions etc on processing: other enactments
Protection of prohibitions and restrictions etc on processing: other enactments 183B 1 This section is about the relationship between— a a pre-commencement enactment which imposes a duty, or confers…
Section 184 — Prohibition of requirement to produce relevant records
Prohibition of requirement to produce relevant records 184 1 It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection…
Section 185 — Avoidance of certain contractual terms relating to health records
Avoidance of certain contractual terms relating to health records 185 1 A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a…
Section 186 — Protection of data subject’s rights
Protection of data subject’s rights 186 1 An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or…
Section 186A — Protection of data subject’s rights: further provision
Protection of data subject’s rights: further provision 186A 1 This section is about the relationship between— a a pre-commencement enactment which prohibits or restricts the disclosure of information…
Section 187 — Representation of data subjects with their authority
Representation of data subjects with their authority 187 1 In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)…
Section 188 — Representation of data subjects with their authority: collective proceedings
Representation of data subjects with their authority: collective proceedings 188 1 The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a…
Section 189 — Duty to review provision for representation of data subjects
Duty to review provision for representation of data subjects 189 1 Before the end of the review period, the Secretary of State must— a review the matters listed in subsection (2) in relation to…
Section 190 — Post-review powers to make provision about representation of data subjects
Post-review powers to make provision about representation of data subjects 190 1 After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations— a exercise…
Section 191 — Framework for Data Processing by Government
Framework for Data Processing by Government 191 1 The Secretary of State may prepare a document, called the Framework for Data Processing by Government, which contains guidance about the processing…
Section 192 — Approval of the Framework
Approval of the Framework 192 1 Before issuing a document prepared under section 191, the Secretary of State must lay it before Parliament. 2 If, within the 40-day period, either House of Parliament…
Section 193 — Publication and review of the Framework
Publication and review of the Framework 193 1 The Secretary of State must publish a document issued under section 192(3). 2 Where an amendment of a document is issued under section 192(3), the…
Section 194 — Effect of the Framework
Effect of the Framework 194 1 When carrying out processing of personal data which is the subject of a document issued under section 192(3) which is for the time being in force, a person must have…
Section 195 — Reserve forces: data-sharing by HMRC
Reserve forces: data-sharing by HMRC 195 1 The Reserve Forces Act 1996 is amended as follows. 2 After section 125 insert— Supply of contact details by HMRC 125A 1 This subsection applies to contact…
Section 196 — Penalties for offences
Penalties for offences 196 1 A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable— a on summary conviction in England and Wales, to a fine; b on summary…
Section 197 — Prosecution
Prosecution 197 1 In England and Wales, proceedings for an offence under this Act may be instituted only— a by the Commissioner, or b by or with the consent of the Director of Public Prosecutions. 2…
Section 198 — Liability of directors etc
Liability of directors etc 198 1 Subsection (2) applies where— a an offence under this Act has been committed by a body corporate, and b it is proved to have been committed with the consent or…
Section 199 — Recordable offences
Recordable offences 199 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Regulations under section 27(4) of the Police and Criminal Evidence Act 1984 (recordable offences) may…
Section 200 — Guidance about PACE codes of practice
Guidance about PACE codes of practice 200 1 The Commissioner must produce and publish guidance about how the Commissioner proposes to perform the duty under section 67(9) of the Police and Criminal…
Section 201 — Disclosure of information to the Tribunal
Disclosure of information to the Tribunal 201 1 No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the…