Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 51 is up to date with all changes known to be in force on or before 03 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 3Rights of the data subject
Supplementary
51Exercise of rights through the Commissioner
(1)
This section applies where a controller—
(a)
restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),
(b)
restricts under section 45(4) the data subject’s rights under section 45(1) (right of access),
F1(ba)
relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege), or
(c)
refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.
(2)
The data subject may—
(a)
where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;
F2(aa)
where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;
(b)
where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject’s request was lawful.
(3)
The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).
(4)
After taking those steps, the Commissioner must inform the data subject—
(a)
where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;
F3(aa)
where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;
(b)
where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller’s refusal of the data subject’s request was lawful.
(5)
The Commissioner must also inform the data subject of the data subject’s right to apply to a court under section 167.
(6)
Where the Commissioner is not satisfied as mentioned in subsection (4)(a) F4, (aa) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .