Data Protection Act 2018 (c. 12) – Section 143 – Information notices: restrictions

Sections

Section 143Information notices: restrictions

(1) The [^F1Commission] may not give an information notice with respect to the processing of personal data for the special purposes unless—

(a)
a determination under section 174 with respect to the data or the processing has taken effect, or
(b)
the [^F1Commission]—
- (i)
  has reasonable grounds for suspecting that such a determination could be made, and
- (ii)
  the information [^F2or documents are] required for the purposes of making such a determination.

(2) An information notice does not require a person to give the [^F1Commission] information [^F3or documents] to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

(3) An information notice does not require a person to give the [^F1Commission] information [^F4or documents to the extent that requiring the person to do so would result in the disclosure] of a communication which is made—

(a)
between a professional legal adviser and the adviser's client, and
(b)
in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(4) An information notice does not require a person to give the [^F1Commission] information [^F5or documents to the extent that requiring the person to do so would result in the disclosure] of a communication which is made—

(a)
between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
(b)
in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
(c)
for the purposes of such proceedings.

(5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(6) An information notice does not require a person to provide the [^F6Commission] with information [^F7or documents] if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.

(7) The reference to an offence in subsection (6) does not include an offence under—

(a)
this Act;
(b)
section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
(c)
section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
(d)
Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(8) An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—

(a)
in giving evidence the person provides information inconsistent with the statement, and
(b)
evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person's behalf.

(9) In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the [^F8UK GDPR], the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 143(1)-(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F2 Words in s. 143(1)(b)(ii) substituted (19.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 97(3)(a), 142(3)(d)
F3 Words in s. 143(2) inserted (19.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 97(3)(b), 142(3)(d)
F4 Words in s. 143(2) substituted (19.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 97(3)(c), 142(3)(d)
F5 Words in s. 143(4) substituted (19.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 97(3)(d), 142(3)(d)
F6 Word in s. 143(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F7 Words in s. 143(6) inserted (19.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 97(3)(e), 142(3)(d)
F8 Words in s. 143(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 60 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I1 S. 143 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

https://dpa2018.digiphile.law/article/article-143.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.