Legislation – Data Protection Act 2018

Data Protection Act 2018, Section 142 is up to date with all changes known to be in force on or before 09 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

PART 6Enforcement

Information notices

142Information notices

(1)

The Commissioner may, by written notice (an “information notice”)—

(a)

require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner’s functions under the data protection legislation, or

(b)

require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—

(i)

investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or

(ii)

determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.

(2)

An information notice must state—

(a)

whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and

(b)

why the Commissioner requires the information.

(3)

An information notice—

(a)

may specify or describe particular information or a category of information;

(b)

may specify the form in which the information must be provided;

(c)

may specify the time at which, or the period within which, the information must be provided;

(d)

may specify the place where the information must be provided;

(but see the restrictions in subsections (5) to (7)).

(4)

An information notice must provide information about—

(a)

the consequences of failure to comply with it, and

(b)

the rights under sections 162 and 164 (appeals etc).

(5)

An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.

(6)

If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.

(7)

If an information notice—

(a)

states that, in the Commissioner’s opinion, the information is required urgently, and

(b)

gives the Commissioner’s reasons for reaching that opinion,

subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.

(8)

The Commissioner may cancel an information notice by written notice to the person to whom it was given.

(9)

In subsection (1), in relation to a person who is a controller or processor for the purposes of the F1UK GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the F1UK GDPR (representatives of controllers or processors not established in F2the United Kingdom).

(10)

Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).