Legislation – Data Protection Act 2018

Data Protection Act 2018, Cross Heading: Definitions is up to date with all changes known to be in force on or before 05 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

PART 4Intelligence services processing

CHAPTER 1Scope and definitions

Definitions

83Meaning of “controller” and “processor”

F1A1

For the purposes of this Part—

(a)

an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and

(b)

a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.

(1)

F2This subsection is satisfied by a person who—

(a)

determines the purposes and means of the processing of personal data, or

(b)

is the controller by virtue of subsection (2).

(2)

Where personal data is processed only—

(a)

for purposes for which it is required by an enactment to be processed, and

(b)

by means by which it is required by an enactment to be processed,

the F3person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3)

In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

84Other definitions

(1)

This section defines other expressions used in this Part.

(2)

“Consent”, in relation to the processing of personal data relating to an individual, means a freely given, specific, informed and unambiguous indication of the individual’s wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data.

F4(2A)

“Designation notice” has the meaning given in section 82A.

(3)

“Employee”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

(4)

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

(5)

“Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a person to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

(6)

“Restriction of processing” means the marking of stored personal data with the aim of limiting its processing for the future.

F5(6A)

“Sensitive processing” has the meaning given in section 86(7).

F6(6B)

“Withdrawal notice” has the meaning given in section 82C.

(7)

Sections 3 and 205 include definitions of other expressions used in this Part.