Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 207 – Territorial application of this Act

Sections

Section 207Territorial application of this Act

(1) This Act applies only to processing of personal data described in subsections [F1 (1A) and (2)].
(1A) [F2 In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.]
(2) [F3In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out] in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.
(3) F4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) [F5Subsections (1), (1A) and (2)] have effect subject to any provision in or made under section 120 providing for the [F6Commission] to carry out functions in relation to other processing of personal data.
(5) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (2).
(6) F7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(7) In this section, references to a person who has an establishment in the United Kingdom include the following—
  • (a)
    an individual who is ordinarily resident in the United Kingdom,
  • (b)
    a body incorporated under the law of the United Kingdom or a part of the United Kingdom,
  • (c)
    a partnership or other unincorporated association formed under the law of the United Kingdom or a part of the United Kingdom, and
  • (d)
    a person not within paragraph (a), (b) or (c) who maintains, and carries on activities through, an office, branch or agency or other stable arrangements in the United Kingdom,

F8....

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Words in s. 207(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 S. 207(1A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F3 Words in s. 207(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 S. 207(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F5 Words in s. 207(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Word in s. 207(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  7. F7 S. 207(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Words in s. 207(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(8) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Modifications etc. (not altering text)

  1. C1 S. 207 modified (30.9.2020) by The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916), arts. 1(2)(b), 4(3)(4)

Commencement Information

  1. I1 S. 207 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

https://dpa2018.digiphile.law/article/article-207.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.