Data Protection Act 2018 (c. 12) – Section 158 – Fixed penalties for non-compliance with charges regulations

Sections

Section 158Fixed penalties for non-compliance with charges regulations

(1) The [^F1Commission] must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137.

(2) The [^F1Commission] may specify different amounts for different types of failure.

(3) The maximum amount that may be specified is 150% of the highest charge payable by a controller in respect of a financial year in accordance with the regulations, disregarding any discount available under the regulations.

(4) The [^F2Commission]—

(a)
may alter or replace the document, and
(b)
must publish any altered or replacement document.

(5) Before publishing a document under this section (including any altered or replacement document), the [^F2Commission] must consult—

(a)
the Secretary of State, and
(b)
such other persons as the [^F2Commission] considers appropriate.

(6) The [^F2Commission] must arrange for a document published under this section (including any altered or replacement document) to be laid before Parliament.

Amended text

This Section is shown as amended by S.I. 2026/386 (see the annotations below), as incorporated in the text in force on 5 November 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 158(1)(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F2 Word in s. 158(4)-(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

I1 S. 158 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

https://dpa2018.digiphile.law/article/article-158.html

Text as at 5 November 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.