Data Protection Act 2018 (c. 12) – Section 102 – General obligations of the controller
Sections
Section 102General obligations of the controller
Each controller must implement appropriate measures—
- (a)to ensure, and
- (b)to be able to demonstrate, in particular to the [F1Commission],
that the processing of personal data complies with the requirements of this Part.
Amended text
This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 Word in s. 102(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
Commencement Information
- I1 S. 102 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(b)
https://dpa2018.digiphile.law/article/article-102.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.