Legislation – Data Protection Act 2018

Data Protection Act 2018, Cross Heading: Supplementary is up to date with all changes known to be in force on or before 08 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.

View outstanding changes

Changes and effects yet to be applied to Part 3 Chapter 3 Crossheading Supplementary:

s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)

Changes and effects yet to be applied to the whole Act associated Parts and Chapters:

Whole provisions yet to be inserted into this Act (including any effects on those provisions):

s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)

PART 3Law enforcement processing

CHAPTER 3Rights of the data subject

Supplementary

51Exercise of rights through the Commissioner

(1)

This section applies where a controller—

(a)

restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),

(b)

restricts under section 45(4) the data subject’s rights under section 45(1) (right of access),

F1(ba)

relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege), or

(c)

refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.

(2)

The data subject may—

(a)

where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;

F2(aa)

where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;

(b)

where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject’s request was lawful.

(3)

The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).

(4)

After taking those steps, the Commissioner must inform the data subject—

(a)

where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;

F3(aa)

where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;

(b)

where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller’s refusal of the data subject’s request was lawful.

(5)

The Commissioner must also inform the data subject of the data subject’s right to apply to a court under section 167.

(6)

Where the Commissioner is not satisfied as mentioned in subsection (4)(a) F4, (aa) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .

52Form of provision of information etc

(1)

The controller must take reasonable steps to ensure that any information that is required by F5or under this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.

(2)

Subject to subsection (3), the information may be provided in any form, including electronic form.

(3)

Where information is provided in response to a request F6made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller must provide the information in the same form as the request where it is practicable to do so.

(4)

Where the controller has reasonable doubts about the identity of an individual making a request F7under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller may—

(a)

request the provision of additional information to enable the controller to confirm the identity, and

(b)

delay dealing with the request until the identity is confirmed.

(5)

Subject to section 53, any information that is required by F8or under this Chapter to be provided to the data subject must be provided free of charge.

(6)

The controller must facilitate the exercise of the rights of the data subject F9arising under or by virtue of sections 45 to 50D.

53Manifestly unfounded or excessive requests by the data subject

(1)

Where a request F10made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller may—

(a)

charge a reasonable fee for dealing with the request, or

(b)

refuse to act on the request.

(2)

An example of a request that may be excessive is one that merely repeats the substance of previous requests.

(3)

In any proceedings where there is an issue as to whether a request F11described in subsection (1) is manifestly unfounded or excessive, it is for the controller to show that it is.

(4)

The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).

F12(4A)

The Secretary of State may by regulations—

(a)

require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and

(b)

specify what the guidance must include.

(5)

Regulations under F13this section are subject to the negative resolution procedure.

F14(6)

If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—

(a)

the reasons for not doing so, and

(b)

the data subject’s right to lodge a complaint with the Commissioner.

(7)

The controller must comply with subsection (6)—

(a)

without undue delay, and

(b)

in any event, before the end of the applicable time period (as to which see section 54).

54Meaning of “applicable time period”

(1)

This section defines “the applicable time period” for the purposes of sections 45(3)(b) F15and (5) F16, 48(2)(b) and 53(7).

(2)

“The applicable time period” means the period of F17one month beginning with the relevant time F18, subject to subsection (3A).

(3)

“The relevant time” means the latest of the following—

(a)

when the controller receives the request in question;

(b)

when the controller receives the information (if any) requested in connection with a request under section 52(4);

(c)

when the fee (if any) charged in connection with the request under section 53 is paid.

F19(3A)

The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

(a)

the complexity of requests made by the data subject, or

(b)

the number of such requests.

(3B)

A notice under subsection (3A) must—

(a)

be given before the end of the period of one month beginning with the relevant time, and

(b)

state the reasons for the delay.

(3C)

Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—

(a)

the controller may ask the data subject to provide the further information, and

(b)

the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—

(i)

the applicable time period, or

(ii)

the period described in subsection (3B)(a).

(3D)

An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.

F20(4)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F20(5)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F20(6)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .