Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 65 is up to date with all changes known to be in force on or before 09 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 4Controller and processor
General obligations
65Prior consultation with the Commissioner
(1)
This section applies where a controller intends to create a filing system and process personal data forming part of it.
(2)
The controller must consult the Commissioner prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).
(3)
Where the controller is required to consult the Commissioner under subsection (2), the controller must give the Commissioner—
(a)
the data protection impact assessment prepared under section 64, and
(b)
any other information requested by the Commissioner to enable the Commissioner to make an assessment of the compliance of the processing with the requirements of this Part.
(4)
Where the Commissioner is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commissioner must provide written advice to the controller and, where the controller is using a processor, to the processor.
(5)
The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.
(6)
The Commissioner may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.
(7)
If the Commissioner extends the period of 6 weeks, the Commissioner must—
(a)
inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and
(b)
provide reasons for the delay.