Data Protection Act 2018 (c. 12) – Section 158 – Fixed penalties for non-compliance with charges regulations
Sections
Section 158Fixed penalties for non-compliance with charges regulations
(1) The [F1Commission] must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137.
(3) The maximum amount that may be specified is 150% of the highest charge payable by a controller in respect of a financial year in accordance with the regulations, disregarding any discount available under the regulations.
(4) The [F2Commission]—
- (a)may alter or replace the document, and
- (b)must publish any altered or replacement document.
(5) Before publishing a document under this section (including any altered or replacement document), the [F2Commission] must consult—
- (a)the Secretary of State, and
- (b)such other persons as the [F2Commission] considers appropriate.
(6) The [F2Commission] must arrange for a document published under this section (including any altered or replacement document) to be laid before Parliament.
Amended text
This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 Word in s. 158(1)(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F2 Word in s. 158(4)-(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
Commencement Information
- I1 S. 158 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)
https://dpa2018.digiphile.law/article/article-158.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.