Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 156 is up to date with all changes known to be in force on or before 04 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 6Enforcement
Penalties
156Penalty notices: restrictions
(1)
The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
(a)
a determination under section 174 with respect to the data or the processing has taken effect, and
(b)
a court has granted leave for the notice to be given.
(2)
A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
(a)
the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
(b)
the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
(3)
The Commissioner may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.
(4)
The Commissioner may not give a penalty notice to—
(a)
the Crown Estate Commissioners, or
(b)
a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).
(5)
In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.