Data Protection Act 2018 (c. 12) – Section 103 – Data protection by design
Sections
Section 103Data protection by design
(1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects.
(2) A controller must implement appropriate technical and organisational measures which are designed to ensure that—
- (a)the data protection principles are implemented, and
- (b)risks to the rights and freedoms of data subjects are minimised.
https://dpa2018.digiphile.law/article/article-103.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.