Data Protection Act 2018 (c. 12) – Section 156 – Penalty notices: restrictions
Sections
Section 156Penalty notices: restrictions
(1) The [F1Commission] may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
- (a)a determination under section 174 with respect to the data or the processing has taken effect, and
- (b)a court has granted leave for the notice to be given.
(2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
- (a)the [F2Commission] has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
- (b)the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
(3) The [F3Commission] may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.
(4) The [F3Commission] may not give a penalty notice to—
- (a)the Crown Estate Commissioners, or
- (b)a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).
(5) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the [F3Commission] may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
Amended text
This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 Word in s. 156(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F2 Word in s. 156(2)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F3 Word in s. 156(3)-(5) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
Commencement Information
- I1 S. 156 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)
https://dpa2018.digiphile.law/article/article-156.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.