Section 6Meaning of “controller”

(1) The definition of “controller” in Article [^F14(1)(7)] of the [^F2UK GDPR] has effect subject to—

(2) For the purposes of the [^F3UK GDPR], where personal data is processed only—

(a)
for purposes for which it is required by an enactment to be processed, and
(b)
by means by which it is required by an enactment to be processed,

the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 6 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 67(2), 142(1); S.I. 2026/82, reg. 2(a)
F2 Words in s. 6(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 9 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F3 Words in s. 6(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 9 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I1 S. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

https://dpa2018.digiphile.law/article/article-6.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.