Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 71A is up to date with all changes known to be in force on or before 02 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 4Controller and processor
F1Codes of conduct
71ACodes of conduct
(1)
The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.
(2)
Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.
(3)
For the purposes of this section—
(a)
“public body” means a body or other person whose functions are, or include, functions of a public nature, and
(b)
a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).
(4)
A code of conduct described in subsection (1) may, for example, make provision with regard to—
(a)
lawful and fair processing;
(b)
the collection of personal data;
(c)
the information provided to the public and to data subjects;
(d)
the exercise of the rights of data subjects;
(e)
the measures and procedures referred to in sections 56, 57 and 62;
(f)
the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;
(g)
the transfer of personal data to third countries or international organisations;
(h)
out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.
(5)
The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.
(6)
Where an expert public body does so, the Commissioner must—
(a)
provide the body with an opinion on whether the code correctly reflects the requirements of this Part,
(b)
decide whether to approve the code, and
(c)
if the code is approved, register and publish the code.
(7)
Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.