Legislation – Data Protection Act 2018
Which version?
Latest available (Revised)
Original (As enacted)
Changes to legislation:
Data Protection Act 2018, Cross Heading: Rights of the data subject is up to date with all changes known to be in force on or before 15 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 2General processing
CHAPTER 2 The UK GDPR
Rights of the data subject
12Limits on fees that may be charged by controllers
(1)
The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—
(a)
Article 12(5) of the F1UK GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or
(b)
Article 15(3) of the F2UK GDPR (reasonable fees for provision of further copies).
(2)
The Secretary of State may by regulations—
(a)
require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and
(b)
specify what the guidance must include.
(3)
Regulations under this section are subject to the negative resolution procedure.
13Obligations of credit reference agencies
(1)
This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).
(2)
The controller’s obligations under Article 15(1) to (3) of the F3UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject’s financial standing, unless the data subject has indicated a contrary intention.
(3)
Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the F4UK GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject’s rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).
F513AMeaning of “relevant offence” for purpose of right to erasure
(1)
The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.
(2)
Regulations under this section are subject to the affirmative resolution procedure.
F614Automated decision-making authorised by law: safeguards
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .