Legislation – Data Protection Act 2018

Data Protection Act 2018, SCHEDULE 13 is up to date with all changes known to be in force on or before 10 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

SCHEDULES

SCHEDULE 13Other general functions of the Commissioner

Section 116

General tasks

1 (1)

The Commissioner must—

(a)

monitor and enforce Parts 3 and 4 of this Act;

(b)

promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing of personal data to which those Parts apply;

(c)

advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals’ rights and freedoms with regard to processing of personal data to which those Parts apply;

(d)

promote the awareness of controllers and processors of their obligations under Parts 3 and 4 of this Act;

(e)

on request, provide information to a data subject concerning the exercise of the data subject’s rights under Parts 3 and 4 of this Act and, if appropriate, co-operate with F1… foreign designated authorities to provide such information;

(f)

co-operate with F2… foreign designated authorities with a view to ensuring the consistency of application and enforcement of F2… the Data Protection Convention, including by sharing information and providing mutual assistance;

(g)

conduct investigations on the application of Parts 3 and 4 of this Act, including on the basis of information received from F3… a foreign designated authority or another public authority;

(h)

monitor relevant developments to the extent that they have an impact on the protection of personal data, including the development of information and communication technologies;

F4(i)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2)

Section 3(14)(c) does not apply to the reference to personal data in sub-paragraph (1)(h).

General powers

2

The Commissioner has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4 of this Act applies—

(a)

to notify the controller or the processor of an alleged infringement of Part 3 or 4 of this Act;

(b)

to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of Part 3 or 4 of this Act;

(c)

to issue reprimands to a controller or processor where processing operations have infringed provisions of Part 3 or 4 of this Act;

(d)

to issue, on the Commissioner’s own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.

Definitions

3

In this Schedule—

“foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;

F5…