Legislation – Data Protection Act 2018

Data Protection Act 2018, Cross Heading: Rights of the data subject is up to date with all changes known to be in force on or before 11 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

PART 2General processing

Rights of the data subject

12Limits on fees that may be charged by controllers

(1)

The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—

(a)

Article 12(5) of the F1UK GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or

(b)

Article 15(3) of the F2UK GDPR (reasonable fees for provision of further copies).

(2)

The Secretary of State may by regulations—

(a)

require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and

(b)

specify what the guidance must include.

(3)

Regulations under this section are subject to the negative resolution procedure.

13Obligations of credit reference agencies

(1)

This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).

(2)

The controller’s obligations under Article 15(1) to (3) of the F3UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject’s financial standing, unless the data subject has indicated a contrary intention.

(3)

Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the F4UK GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject’s rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).

14Automated decision-making authorised by law: safeguards

(1)

This section makes provision for the purposes of Article 22(2)(b) of the F5UK GDPR (exception from Article 22(1) of the F5UK GDPR for significant decisions based solely on automated processing that are F6required or authorised under the law of the United Kingdom or a part of the United Kingdom and subject to safeguards for the data subject’s rights, freedoms and legitimate interests).

(2)

A decision is a “significant decision” for the purposes of this section if, in relation to a data subject, it—

(a)

produces legal effects concerning the data subject, or

(b)

similarly significantly affects the data subject.

(3)

A decision is a “qualifying significant decision” for the purposes of this section if—

(a)

it is a significant decision in relation to a data subject,

(b)

it is required or authorised by law, and

(c)

it does not fall within Article 22(2)(a) or (c) of the F7UK GDPR (decisions necessary to a contract or made with the data subject’s consent).

(4)

Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—

(a)

the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and

(b)

the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—

(i)

reconsider the decision, or

(ii)

take a new decision that is not based solely on automated processing.

(5)

If a request is made to a controller under subsection (4), the controller must, within the period described in Article 12(3) of the F8UK GDPR—

(a)

consider the request, including any information provided by the data subject that is relevant to it,

(b)

comply with the request, and

(c)

by notice in writing inform the data subject of—

(i)

the steps taken to comply with the request, and

(ii)

the outcome of complying with the request.

(6)

In connection with this section, a controller has the powers and obligations under Article 12 of the F9UK GDPR (transparency, procedure for extending time for acting on request, fees, manifestly unfounded or excessive requests etc) that apply in connection with Article 22 of the F9UK GDPR.

(7)

The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject’s rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.

(8)

Regulations under subsection (7)—

(a)

may amend this section, and

(b)

are subject to the affirmative resolution procedure.