Data Protection Act 2018 (c. 12) – Section 51 – Exercise of rights through the Commission
Sections
Section 51Exercise of rights through the [F1Commission]
(1) This section applies where a controller—
- (a)restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),
- (b)restricts under section 45(4) the data subject's rights under section 45(1) (right of access),
- (ba)[F2 relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege),] or
- (c)refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.
(2) The data subject may—
- (a)where subsection (1)(a) or (b) applies, request the [F1Commission] to check that the restriction imposed by the controller was lawful;
- (aa)[F3 where subsection (1)(ba) applies, request the [F1Commission] to check that the controller was entitled to rely on the exemption;]
- (b)where subsection (1)(c) applies, request the [F1Commission] to check that the refusal of the data subject's request was lawful.
(3) The [F1Commission] must take such steps as appear to the [F1Commission] to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).
(4) After taking those steps, the [F1Commission] must inform the data subject—
- (a)where subsection (1)(a) or (b) applies, whether the [F1Commission] is satisfied that the restriction imposed by the controller was lawful;
- (aa)[F4 where subsection (1)(ba) applies, whether the [F1Commission] is satisfied that the controller was entitled to rely on the exemption;]
- (b)where subsection (1)(c) applies, whether the [F1Commission] is satisfied that the controller's refusal of the data subject's request was lawful.
(5) The [F1Commission] must also inform the data subject of the data subject's right to apply to a court under section 167.
Amended text
This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 Word in s. 51 substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F2 S. 51(1)(ba) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(a), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)
- F3 S. 51(2)(aa) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(b), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)
- F4 S. 51(4)(aa) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(c), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)
- F5 Word in s. 51(6) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(d), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)
Commencement Information
- I1 S. 51 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)
https://dpa2018.digiphile.law/article/article-51.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.