Legislation – Data (Use and Access) Act 2025

“Duties in carrying out functions

120APrincipal objective

It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation—

(a)

to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and

(b)

to promote public trust and confidence in the processing of personal data.

120BDuties in relation to functions under the data protection legislation

In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances—

(a)

the desirability of promoting innovation;

(b)

the desirability of promoting competition;

(c)

the importance of the prevention, investigation, detection and prosecution of criminal offences;

(d)

the need to safeguard public security and national security;

(e)

the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.

120CStrategy

(1)

The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under—

(a)

sections 120A and 120B,

(b)

section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and

(c)

section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles).

(2)

The Commissioner must—

(a)

review the strategy from time to time, and

(b)

revise the strategy as appropriate.

(3)

The Commissioner must publish the strategy and any revised strategy.

120DDuty to consult other regulators

(1)

The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition.

(2)

The persons are—

(a)

such persons exercising regulatory functions as the Commissioner considers appropriate;

(b)

such other persons as the Commissioner considers appropriate.

(3)

In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015.”

“(1A)

In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)—

(a)

a review of what the Commissioner has done during the reporting period to comply with the duties under—

(i)

sections 120A and 120B,

(ii)

section 108 of the Deregulation Act 2015, and

(iii)

section 21 of the Legislative and Regulatory Reform Act 2006,

including a review of the operation of the strategy prepared and published under section 120C;

(b)

a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D.

(1B)

In subsection (1A), “the reporting period” means the period to which the report relates.”