Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 17 – Accreditation of certification providers

Sections

Section 17Accreditation of certification providers

(1) Accreditation of a person as a certification provider is only valid when carried out by—
  • (a)
    the [F1Commission], or
  • (b)
    the [F2UK national accreditation body].
(2) The [F3Commission] may only accredit a person as a certification provider where the [F3Commission]—
  • (a)
    has published a statement that the [F3Commission] will carry out such accreditation, and
  • (b)
    has not published a notice withdrawing that statement.
(3) The [F4UK national accreditation body] may only accredit a person as a certification provider where the [F3Commission]—
  • (a)
    has published a statement that the body may carry out such accreditation, and
  • (b)
    has not published a notice withdrawing that statement.
(4) The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.
(5) Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.
(6) The [F5UK national accreditation body] may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the [F6UK GDPR].
(7) The [F7UK national accreditation body] must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the [F8UK GDPR] as the Secretary of State may reasonably require.
(8) In this section—
  • “certification provider” means a person who issues certification for the purposes of Article 42 of the [F9UK GDPR];
  • “the [F10UK national accreditation body]” means the [F10UK national accreditation body] for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Word in s. 17(1)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  2. F2 Words in s. 17(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F3 Word in s. 17(2)(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  4. F4 Words in s. 17(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F5 Words in s. 17(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Words in s. 17(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F7 Words in s. 17(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Words in s. 17(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  9. F9 Words in s. 17(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  10. F10 Words in s. 17(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

  1. I1 S. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

https://dpa2018.digiphile.law/article/article-17.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.