Legislation – Data Protection Act 2018

Data Protection Act 2018, Section 209 is up to date with all changes known to be in force on or before 03 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.

View outstanding changes

Changes and effects yet to be applied to Section 209:

s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)

Changes and effects yet to be applied to the whole Act associated Parts and Chapters:

Whole provisions yet to be inserted into this Act (including any effects on those provisions):

s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)

PART 7Supplementary and final provision

General

209Application to the Crown

(1)

This Act binds the Crown.

(2)

For the purposes of the F1UK GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).

(3)

Where government departments are not able to enter into contracts with each other, a provision of the F2UK GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.

(4)

Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the F3UK GDPR and this Act is—

(a)

in relation to the Royal Household, the Keeper of the Privy Purse,

(b)

in relation to the Duchy of Lancaster, such person as the Chancellor of the Duchy appoints, and

(c)

in relation to the Duchy of Cornwall, such person as the Duke of Cornwall, or the possessor for the time being of the Duchy of Cornwall, appoints.

(5)

Different persons may be appointed under subsection (4)(b) or (c) for different purposes.

(6)

As regards criminal liability—

(a)

a government department is not liable to prosecution under this Act;

(b)

nothing in subsection (4) makes a person who is a controller by virtue of that subsection liable to prosecution under this Act;

(c)

a person in the service of the Crown is liable to prosecution under the provisions of this Act listed in subsection (7).

(7)

Those provisions are—

(a)

section 119;

(b)

section 170;

(c)

section 171;

(d)

section 173;

(e)

paragraph 15 of Schedule 15.