Data Protection Act 2018 (c. 12) – Section 161A – Annual report on regulatory action
Sections
Section 161A[F1Annual report on regulatory action
(1) The [F2Commission] must produce and publish an annual report containing the information described in subsections (2) to (5).
(2) The report must include the following information about UK GDPR investigations—
- (a)the number of investigations begun, continued or completed by the [F3Commission] during the reporting period,
- (b)the different types of act and omission that were the subject matter of the investigations,
- (c)the enforcement powers exercised by the [F4Commission] in the reporting period in connection with the investigations,
- (d)the duration of investigations that ended in the reporting period, and
- (e)the different types of outcome in investigations that ended in that period.
(3) The report must include information about the enforcement powers exercised by the [F5Commission] in the reporting period in connection with—
- (a)processing of personal data by a competent authority for any of the law enforcement purposes, and
- (b)processing of personal data to which Part 4 applies.
(4) The information included in the report in accordance with subsections (2) and (3) must include information about—
- (a)the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and
- (b)the reasons why that happened.
(5) The report must include a review of how the [F6Commission] had regard to the guidance published under section 160 when exercising the [F6Commission's] enforcement powers as described in subsections (2)(c) and (3).
(6) In this section—
- “enforcement powers” means the powers under—
- (a)Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,
- (b)sections 142 to 159 of this Act,
- (c)paragraph 2(a), (b) and (c) of Schedule 13 to this Act, and
- (d)Schedules 15 and 16 to this Act;
- (a)
- “the law enforcement purposes” has the meaning given in section 31 of this Act;
- “the reporting period” means the period to which the report relates;
- “UK GDPR investigation” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).]
Amended text
This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 S. 161A inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 102(4), 142(1); S.I. 2025/904, reg. 2(i)
- F2 Word in s. 161A(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F3 Word in s. 161A(2)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F4 Word in s. 161A(2)(c) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F5 Word in s. 161A(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F6 Word in s. 161A(5) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
https://dpa2018.digiphile.law/article/article-161A.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.