Data Protection Act 2018 (c. 12) – Section 177 – Guidance about how to seek redress against media organisations

Sections

Section 177Guidance about how to seek redress against media organisations

(1) The [^F1Commission] must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or has failed to comply with the data protection legislation.

(2) In this section, “media organisation” means a body or other organisation whose activities consist of or include journalism.

(3) The guidance must include provision about relevant complaints procedures, including—

(a)
who runs them,
(b)
what can be complained about, and
(c)
how to make a complaint.

(4) For the purposes of subsection (3), relevant complaints procedures include procedures for making complaints to the [^F2Commission], the Office of Communications, the British Broadcasting Corporation and other persons who produce or enforce codes of practice for media organisations.

(5) The guidance must also include provision about—

(a)
the powers available to the [^F3Commission] in relation to a failure to comply with the data protection legislation,
(b)
when a claim in respect of such a failure may be made before a court and how to make such a claim,
(c)
alternative dispute resolution procedures,
(d)
the rights of bodies and other organisations to make complaints and claims on behalf of data subjects, and
(e)
the [^F4Commission's] power to provide assistance in special purpose proceedings.

(6) The [^F5Commission]—

(a)
may alter or replace the guidance, and
(b)
must publish any altered or replacement guidance.

(7) The Commissioner must produce and publish the first guidance under this section before the end of the period of 1 year beginning when this Act is passed.

Amended text

This Section is shown as amended by S.I. 2026/386 (see the annotations below), as incorporated in the text in force on 5 November 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 177(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F2 Word in s. 177(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F3 Word in s. 177(5)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F4 Word in s. 177(5)(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F5 Word in s. 177(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

I1 S. 177 in force at 23.7.2018, see s. 212(3)(c)

https://dpa2018.digiphile.law/article/article-177.html

Text as at 5 November 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.