Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 191 is up to date with all changes known to be in force on or before 01 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.
Changes and effects yet to be applied to Section 191:
- s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
- s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
- s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
- s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
- s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
- s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
- s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
- s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
- s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
- s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
- s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
- Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)
Changes and effects yet to be applied to the whole Act associated Parts and Chapters:
Whole provisions yet to be inserted into this Act (including any effects on those provisions):
- s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
- s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
- s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
- s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
- s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
- s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
- s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
- s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
- s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
- s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
- s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
- Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)
PART 7Supplementary and final provision
Framework for Data Processing by Government
191Framework for Data Processing by Government
(1)
The Secretary of State may prepare a document, called the Framework for Data Processing by Government, which contains guidance about the processing of personal data in connection with the exercise of functions of—
(a)
the Crown, a Minister of the Crown or a United Kingdom government department, and
(b)
a person with functions of a public nature who is specified or described in regulations made by the Secretary of State.
(2)
The document may make provision relating to all of those functions or only to particular functions or persons.
(3)
The document may not make provision relating to, or to the functions of, a part of the Scottish Administration, the Welsh Government, a Northern Ireland Minister or a Northern Ireland department.
(4)
The Secretary of State may from time to time prepare amendments of the document or a replacement document.
(5)
Before preparing a document or amendments under this section, the Secretary of State must consult—
(a)
the Commissioner, and
(b)
any other person the Secretary of State considers it appropriate to consult.
(6)
Regulations under subsection (1)(b) are subject to the negative resolution procedure.
(7)
In this section, “Northern Ireland Minister” includes the First Minister and deputy First Minister in Northern Ireland.