Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 48 – Rights under section 46 or 47: supplementary

Sections

Section 48Rights under section 46 or 47: supplementary

(1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—
  • (a)
    whether the request has been granted, and
  • (b)
    if it has been refused—
    • (i)
      of the reasons for the refusal,
    • (ii)
      of the data subject's right to make a request to the [F1Commission] under section 51,
    • (iia)
      [F2 of the data subject’s right to make a complaint to the controller under section 164A,]
    • (iii)
      of the data subject's right to lodge a complaint with the [F1Commission] [F3under section 165], and
    • (iv)
      of the data subject's right to apply to a court under section 167.
(2) The controller must comply with the duty under subsection (1)—
  • (a)
    without undue delay, and
  • (b)
    in any event, before the end of the applicable time period (see section 54).
(3) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
  • (a)
    avoid obstructing an official or legal inquiry, investigation or procedure;
  • (b)
    avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
  • (c)
    protect public security;
  • (d)
    F4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
  • (e)
    protect the rights and freedoms of others.
(4) Where the rights of a data subject under subsection [F5(1)(b)(i)] are restricted [F6under subsection (3)], wholly or partly, the controller must inform the data subject in writing without undue delay—
  • (a)
    that the rights of the data subject have been restricted,
  • (b)
    of the reasons for the restriction,
  • (ba)
    [F7 of the data subject’s right to make a complaint to the controller under section 164A,]
  • (c)
    of the data subject's right to lodge a complaint with the [F8Commission] [F9under section 165], and
  • (d)
    of the data subject's right to apply to a court under section 167.
(5) Subsection (4)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.
(6) The controller must—
  • (a)
    record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i) [F10in reliance on subsection (3)], and
  • (b)
    if requested to do so by the [F11Commission], make the record available to the [F11Commission].
(7) Where the controller rectifies personal data, it must notify the competent authority (if any) from which the inaccurate personal data originated.
(8) F12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(9) Where the controller rectifies, erases or restricts the processing of personal data which has been disclosed by the controller—
  • (a)
    the controller must notify the recipients, and
  • (b)
    the recipients must similarly rectify, erase or restrict the processing of the personal data (so far as they retain responsibility for it).
(10) Where processing is restricted in accordance with section 47(3), the controller must inform the data subject before lifting the restriction.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Word in s. 48(1)(b)(ii)(iii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  2. F2 S. 48(1)(b)(iia) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 13(2)(a); S.I. 2026/82, reg. 3(b) (with reg. 7)
  3. F3 Words in s. 48(1)(b)(iii) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 13(2)(b); S.I. 2026/82, reg. 3(b) (with reg. 7)
  4. F4 S. 48(3)(d) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  5. F5 Word in s. 48(4) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(b)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  6. F6 Words in s. 48(4) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(b)(ii), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  7. F7 S. 48(4)(ba) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 13(3)(a); S.I. 2026/82, reg. 3(b) (with reg. 7)
  8. F8 Word in s. 48(4)(c) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  9. F9 Words in s. 48(4)(c) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 13(3)(b); S.I. 2026/82, reg. 3(b) (with reg. 7)
  10. F10 Words in s. 48(6)(a) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  11. F11 Word in s. 48(6)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  12. F12 S. 48(8) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 38 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

  1. I1 S. 48 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-48.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.