Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 187 – Representation of data subjects with their authority

Sections

Section 187Representation of data subjects with their authority

(1) In relation to the processing of personal data to which the [F1UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)]—
  • (a)
    F2... enables a data subject to authorise a body or other organisation which meets the conditions set out in [F3subsections (3) and (4)] to exercise the data subject's rights under [F4sections 164A and 165 (complaints) and Articles] 78 and 79 of the [F5UK GDPR] (rights F6... to an effective judicial remedy) on the data subject's behalf, and
  • (b)
    [F7also authorises] such a body or organisation to exercise the data subject's rights under Article 82 of the [F8UK GDPR] (right to compensation).
(2) In relation to the processing of personal data to which the [F9UK GDPR] does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf—
  • (za)
    [F10 the right under section 164A (complaints to the controller);]
  • (a)
    rights under section [F11165] (complaints to the [F12Commission]);
  • (b)
    rights under section 166(2) (orders for the [F12Commission] to progress complaints);
  • (c)
    rights under section 167(1) (compliance orders);
  • (d)
    the right to bring judicial review proceedings against the [F13Commission].
(3) The first condition is that the body or organisation, by virtue of its constitution or an enactment—
  • (a)
    is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,
  • (b)
    is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and
  • (c)
    has objectives which are in the public interest.
(4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data.
(5) In this Act, references to a “representative body”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the [F14UK GDPR] or this section.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Words in s. 187(1) substituted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 Words in s. 187(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F3 Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Words in s. 187(1)(a) substituted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 21(2)(a); S.I. 2026/82, reg. 3(b) (with reg. 7)
  5. F5 Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Words in s. 187(1)(a) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 21(2)(b); S.I. 2026/82, reg. 3(b) (with reg. 7)
  7. F7 Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  9. F9 Words in s. 187(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  10. F10 S. 187(2)(za) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 21(3)(a); S.I. 2026/82, reg. 3(b) (with reg. 7)
  11. F11 Word in s. 187(2)(a) substituted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 21(3)(b); S.I. 2026/82, reg. 3(b) (with reg. 7)
  12. F12 Word in s. 187(2)(a)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  13. F13 Word in s. 187(2)(d) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  14. F14 Words in s. 187(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

  1. I1 S. 187 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

https://dpa2018.digiphile.law/article/article-187.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.