Data Protection Act 2018 (c. 12) – Section 196 – Penalties for offences
Sections
Section 196Penalties for offences
(1) A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable—
- (a)on summary conviction in England and Wales, to a fine;
- (b)on summary conviction in Scotland or Northern Ireland, to a fine not exceeding level 5 on the standard scale.
(2) A person who commits an offence under section 132, 144, 148, [F1148C,] 170, 171 or 184 is liable—
- (a)on summary conviction in England and Wales, to a fine;
- (b)on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;
- (c)on conviction on indictment, to a fine.
(3) Subsections (4) and (5) apply where a person is convicted of an offence under section 170 or 184.
(4) The court by or before which the person is convicted may order a document or other material to be forfeited, destroyed or erased if—
- (a)it has been used in connection with the processing of personal data, and
- (b)it appears to the court to be connected with the commission of the offence,
subject to subsection (5).
(5) If a person, other than the offender, who claims to be the owner of the material, or to be otherwise interested in the material, applies to be heard by the court, the court must not make an order under subsection (4) without giving the person an opportunity to show why the order should not be made.
Amended text
This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 Word in s. 196(2) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(10), 142(1); S.I. 2026/82, reg. 2(s)
Commencement Information
- I1 S. 196 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
https://dpa2018.digiphile.law/article/article-196.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.