Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 44 – ... Controller's general duties

Sections

Section 44F1... Controller's general duties

(1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)—
  • (a)
    the identity and the contact details of the controller;
  • (b)
    where applicable, the contact details of the data protection officer (see sections 69 to 71);
  • (c)
    the purposes for which the controller processes personal data;
  • (d)
    the existence of the rights of data subjects to request from the controller—
    • (i)
      access to personal data (see section 45),
    • (ii)
      rectification of personal data (see section 46), and
    • (iii)
      erasure of personal data or the restriction of its processing (see section 47);
  • (da)
    [F2 the existence of the right to make a complaint to the controller (see section 164A);]
  • (e)
    the existence of the right to lodge a complaint with the [F3Commission] [F4(see section 165)] and the contact details of the [F3Commission].
(2) The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following—
  • (a)
    information about the legal basis for the processing;
  • (b)
    information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;
  • (c)
    where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations);
  • (d)
    such further information as is necessary to enable the exercise of the data subject's rights under this Part.
(3) An example of where further information may be necessary as mentioned in subsection (2)(d) is where the personal data being processed was collected without the knowledge of the data subject.
(4) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
  • (a)
    avoid obstructing an official or legal inquiry, investigation or procedure;
  • (b)
    avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
  • (c)
    protect public security;
  • (d)
    F5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
  • (e)
    protect the rights and freedoms of others.
(5) Where the provision of information to a data subject under subsection (2) is restricted [F6under subsection (4)], wholly or partly, the controller must inform the data subject in writing without undue delay—
  • (a)
    that the provision of information has been restricted,
  • (b)
    of the reasons for the restriction,
  • (c)
    of the data subject's right to make a request to the [F7Commission] under section 51,
  • (ca)
    [F8 of the data subject’s right to make a complaint to the controller under section 164A,]
  • (d)
    of the data subject's right to lodge a complaint with the [F7Commission] [F9under section 165], and
  • (e)
    of the data subject's right to apply to a court under section 167.
(6) Subsection (5)(a) and (b) do not apply to the extent that complying with them would undermine the purpose of the restriction.
(7) The controller must—
  • (a)
    record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2) [F10in reliance on subsection (4)], and
  • (b)
    if requested to do so by the [F11Commission], make the record available to the [F11Commission].

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Word in s. 44 heading omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 79(4), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)
  2. F2 S. 44(1)(da) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 10(2)(a); S.I. 2026/82, reg. 3(b) (with reg. 7)
  3. F3 Word in s. 44(1)(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  4. F4 Words in s. 44(1)(e) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 10(2)(b); S.I. 2026/82, reg. 3(b) (with reg. 7)
  5. F5 S. 44(4)(d) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(3)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  6. F6 Words in s. 44(5) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(3)(b), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  7. F7 Word in s. 44(5)(c)(d) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  8. F8 S. 44(5)(ca) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 10(3)(a); S.I. 2026/82, reg. 3(b) (with reg. 7)
  9. F9 Words in s. 44(5)(d) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 10(3)(b); S.I. 2026/82, reg. 3(b) (with reg. 7)
  10. F10 Words in s. 44(7)(a) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(3)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  11. F11 Word in s. 44(7)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

  1. I1 S. 44 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-44.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.