Data Protection Act 2018 (c. 12) – Section 170 – Unlawful obtaining etc of personal data

Sections

Section 170Unlawful obtaining etc of personal data

(1) It is an offence for a person knowingly or recklessly—

(a)
to obtain or disclose personal data without the consent of the controller,
(b)
to procure the disclosure of personal data to another person without the consent of the controller, or
(c)
after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.

(2) It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—

(a)
was necessary for the purposes of preventing [^F1, investigating] or detecting crime,
(b)
was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
(c)
in the particular circumstances, was justified as being in the public interest.

(3) It is also a defence for a person charged with an offence under subsection (1) to prove that—

(a)
the person acted in the reasonable belief that the person had a legal right to do the obtaining, disclosing, procuring or retaining,
(b)
the person acted in the reasonable belief that the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or
(c)
the person acted—
- (i)
  for the special purposes,
- (ii)
  with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- (iii)
  in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest.

(4) It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed.

(5) It is an offence for a person to offer to sell personal data if the person—

(a)
has obtained the data in circumstances in which an offence under subsection (1) was committed, or
(b)
subsequently obtains the data in such circumstances.

(6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.

(7) In this section—

(a)
references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the [^F2UK GDPR] or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
(b)
where there is more than one controller, such references are references to the consent of one or more of them.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 170(2)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 22; S.I. 2026/82, reg. 2(z12)
F2 Words in s. 170(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 71 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I1 S. 170 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

https://dpa2018.digiphile.law/article/article-170.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.