Data Protection Act 2018 (c. 12) – Section 138 – Regulations under section 137: supplementary

Sections

Section 138Regulations under section 137: supplementary

(1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate (and see also section 182).

(2) The [^F1Commission] —

(a)
must keep under review the working of regulations under section 137(1) or (6), and
(b)
may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.

(3) The Secretary of State must review the working of regulations under section 137(1) or (6)—

(a)
at the end of the period of 5 years beginning with the making of the first set of regulations under section 108 of the Digital Economy Act 2017, and
(b)
at the end of each subsequent 5 year period.

(4) Regulations under section 137(1) are subject to the negative resolution procedure if—

(a)
they only make provision increasing a charge for which provision is made by previous regulations under section 137(1) or section 108(1) of the Digital Economy Act 2017, and
(b)
they do so to take account of an increase in the retail prices index since the previous regulations were made.

(5) Subject to subsection (4), regulations under section 137(1) or (6) are subject to the affirmative resolution procedure.

(6) In subsection (4), “the retail prices index” means—

(a)
the general index of retail prices (for all items) published by the Statistics Board, or
(b)
where that index is not published for a month, any substitute index or figures published by the Board.

(7) Regulations under section 137(1) or (6) may not apply to—

(a)
Her Majesty in her private capacity,
(b)
Her Majesty in right of the Duchy of Lancaster, or
(c)
the Duke of Cornwall.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 138(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

I1 S. 138 in force at Royal Assent for specified purposes, see s. 212(2)(f)
I2 S. 138 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(e)

https://dpa2018.digiphile.law/article/article-138.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.