Data Protection Act 2018 (c. 12) – Section 190 – Post-review powers to make provision about representation of data subjects

Sections

Section 190Post-review powers to make provision about representation of data subjects

(1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—

(a)
exercise the powers under Article 80(2) of the [^F1UK GDPR] in relation to England and Wales and Northern Ireland,
(b)
make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the [^F1UK GDPR] to exercise a data subject's rights under Article 82 of the [^F1UK GDPR] in England and Wales and Northern Ireland without being authorised to do so by the data subject, and
(c)
make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.

(2) The powers under subsection (1) include power—

(a)
to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject's rights;
(b)
to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject's rights;
(c)
to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;
(d)
to confer functions on a person, including functions involving the exercise of a discretion;
(e)
to amend sections 166 to 168, 180, 187, 203, 205 and 206;
(f)
to insert new sections and Schedules into Part 6 or 7 ;
(g)
to make different provision in relation to England and Wales and in relation to Northern Ireland.

(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.

(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—

(a)
the effect of judgments and orders;
(b)
agreements to settle claims;
(c)
the assessment of the amount of compensation;
(d)
the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
(e)
costs.

(5) Regulations under this section are subject to the affirmative resolution procedure.

Annotations

Textual Amendments

F1 Words in s. 190(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 84 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I1 S. 190 in force at Royal Assent for specified purposes, see s. 212(2)(f)
I2 S. 190 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(g)

https://dpa2018.digiphile.law/article/article-190.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.