Section 142Information notices

(1) The [^F1Commission] may, by written notice (an “information notice”)—

• (a)
  require a controller or processor to provide the [^F1Commission] with information [^F2or documents] that the [^F1Commission] reasonably requires for the purposes of carrying out the [^F1Commission's] functions under the data protection legislation, or
• (b)
  require any person to provide the [^F1Commission] with information [^F3or documents] that the [^F1Commission] reasonably requires for the purposes of—

  • (i)
    investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or
  • (ii)
    determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.

(2) An information notice must state—

• (a)
  whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and
• (b)
  why the [^F1Commission] requires the information [^F4or documents].

(3) An information notice—

• (a)
  may specify or describe particular information [^F5or documents] or a category of information [^F5or documents];
• (b)
  may specify the form in which the information [^F6or documents] must be provided;
• (c)
  may specify the time at which, or the period within which, the information [^F7or documents] must be provided;
• (d)
  may specify the place where the information [^F8or documents] must be provided;

(but see the restrictions in subsections (5) to (7)).

(4) An information notice must provide information about—

• (a)
  the consequences of failure to comply with it, and
• (b)
  the rights under sections 162 and 164 (appeals etc).

(5) An information notice may not require a person to provide information [^F9or documents] before the end of the period within which an appeal can be brought against the notice.

(6) If an appeal is brought against an information notice, the information [^F10or documents] need not be provided pending the determination or withdrawal of the appeal.

(7) If an information notice—

• (a)
  states that, in the [^F11Commission's] opinion, the information[^F12or documents are] required urgently, and
• (b)
  gives the [^F11Commission's] reasons for reaching that opinion,

subsections (5) and (6) do not apply but the notice must not require the information [^F13or documents] to be provided before the end of the period of 24 hours beginning when the notice is given.

(8) The [^F11Commission] may cancel an information notice by written notice to the person to whom it was given.

(9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the [^F14UK GDPR], the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the [^F14UK GDPR] (representatives of controllers or processors not established in [^F15the United Kingdom]).

(10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).