Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 38 is up to date with all changes known to be in force on or before 01 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 2Principles
38The fourth data protection principle
(1)
The fourth data protection principle is that—
(a)
personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and
(b)
every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay.
(2)
In processing personal data for any of the law enforcement purposes, personal data based on facts must, so far as possible, be distinguished from personal data based on personal assessments.
(3)
In processing personal data for any of the law enforcement purposes, a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject, such as—
(a)
persons suspected of having committed or being about to commit a criminal offence;
(b)
persons convicted of a criminal offence;
(c)
persons who are or may be victims of a criminal offence;
(d)
witnesses or other persons with information about offences.
(4)
All reasonable steps must be taken to ensure that personal data which is inaccurate, incomplete or no longer up to date is not transmitted or made available for any of the law enforcement purposes.
(5)
For that purpose—
(a)
the quality of personal data must be verified before it is transmitted or made available,
(b)
in all transmissions of personal data, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date must be included, and
(c)
if, after personal data has been transmitted, it emerges that the data was incorrect or that the transmission was unlawful, the recipient must be notified without delay.