Legislation – Data Protection Act 2018

Data Protection Act 2018, Cross Heading: … is up to date with all changes known to be in force on or before 03 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

PART 3Law enforcement processing

CHAPTER 3Rights of the data subject

F1…

45Right of access by the data subject

(1)

A data subject is entitled to obtain from the controller—

(a)

confirmation as to whether or not personal data concerning him or her is being processed, and

(b)

where that is the case, access to the personal data and the information set out in subsection (2).

(2)

That information is—

(a)

the purposes of and legal basis for the processing;

(b)

the categories of personal data concerned;

(c)

the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);

(d)

the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;

(e)

the existence of the data subject’s rights to request from the controller—

(i)

rectification of personal data (see section 46), and

(ii)

erasure of personal data or the restriction of its processing (see section 47);

(f)

the existence of the data subject’s right to lodge a complaint with the Commissioner and the contact details of the Commissioner;

(g)

communication of the personal data undergoing processing and of any available information as to its origin.

F2(2A)

Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

(3)

Where a data subject makes a request under subsection (1), the information to which the data subject is entitled must be provided in writing —

(a)

without undue delay, and

(b)

in any event, before the end of the applicable time period (as to which see section 54).

(4)

The controller may restrict, wholly or partly, the rights conferred by subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a)

avoid obstructing an official or legal inquiry, investigation or procedure;

(b)

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c)

protect public security;

F3(d)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e)

protect the rights and freedoms of others.

(5)

Where the rights of a data subject under subsection (1) are restricted F4under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay—

(a)

that the rights of the data subject have been restricted,

(b)

of the reasons for the restriction,

(c)

of the data subject’s right to make a request to the Commissioner under section 51,

(d)

of the data subject’s right to lodge a complaint with the Commissioner, and

(e)

of the data subject’s right to apply to a court under section 167.

(6)

Subsection (5)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.

(7)

The controller must—

(a)

record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1) F5in reliance on subsection (4), and

(b)

if requested to do so by the Commissioner, make the record available to the Commissioner.

F645AExemption from sections 44 and 45: legal professional privilege

(1)

Sections 44(2) and 45(1) do not require the controller to give the data subject—

(a)

information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

(b)

information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

(2)

A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

(a)

the decision to rely on the exemption,

(b)

the reason for the decision,

(c)

the data subject’s right to make a request to the Commissioner under section 51,

(d)

the data subject’s right to lodge a complaint with the Commissioner under section 165, and

(e)

the data subject’s right to apply to a court under section 167.

(3)

Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

(a)

undermine a claim described in subsection (1)(a), or

(b)

conflict with a duty described in subsection (1)(b).

(4)

The controller must—

(a)

record the reason for a decision to rely on the exemption in subsection (1), and

(b)

if requested to do so by the Commissioner, make the record available to the Commissioner.

(5)

The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).