Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 166 – Orders to progress complaints to the Commission

Sections

Section 166Orders to progress complaints [F1to the [F2Commission]]

(1) This section applies where, after a data subject makes a complaint under section 165 F3..., the [F4Commission]—
  • (a)
    fails to take appropriate steps to respond to the complaint,
  • (b)
    fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the [F4Commission] received the complaint, or
  • (c)
    if the [F4Commission's] consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the [F4Commission]—
  • (a)
    to take appropriate steps to respond to the complaint, or
  • (b)
    to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the [F4Commission]—
  • (a)
    to take steps specified in the order;
  • (b)
    to conclude an investigation, or take a specified step, within a period specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Words in s. 166 heading inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 20(2); S.I. 2026/82, reg. 3(b) (with reg. 7)
  2. F2 Word in s. 166 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3) (with reg. 1(5)); S.I. 2026/1015, reg. 2(c)
  3. F3 Words in s. 166(1) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 20(3); S.I. 2026/82, reg. 3(b) (with reg. 7)
  4. F4 Word in s. 166(1)-(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

  1. I1 S. 166 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

https://dpa2018.digiphile.law/article/article-166.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.