Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 167 is up to date with all changes known to be in force on or before 09 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 6Enforcement
Remedies in the court
167Compliance orders
(1)
This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject’s rights under the data protection legislation in contravention of that legislation.
(2)
A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—
(a)
to take steps specified in the order, or
(b)
to refrain from taking steps specified in the order.
(3)
The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.
(4)
In subsection (1)—
(a)
the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the F1UK GDPR (right to an effective remedy against a controller or processor);
(b)
the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.
(5)
In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.