Section 62Logging

(1) A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following processing operations in automated processing systems—

(a)
collection;
(b)
alteration;
(c)
consultation;
(d)
disclosure (including transfers);
(e)
combination;
(f)
erasure.

(2) The logs of consultation must make it possible to establish—

(a)
the ^F1... date and time of, the consultation, and
(b)
so far as possible, the identity of the person who consulted the data.

(3) The logs of disclosure must make it possible to establish—

(a)
the ^F2... date and time of, the disclosure, and
(b)
so far as possible—
- (i)
  the identity of the person who disclosed the data, and
- (ii)
  the identity of the recipients of the data.

(4) The logs kept under subsection (1) may be used only for one or more of the following purposes—

(a)
to verify the lawfulness of processing;
(b)
to assist with self-monitoring by the controller or (as the case may be) the processor, including the conduct of internal disciplinary proceedings;
(c)
to ensure the integrity and security of personal data;
(d)
the purposes of criminal proceedings.

(5) The controller or (as the case may be) the processor must make the logs available to the [^F3Commission] on request.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Words in s. 62(2)(a) omitted (19.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 82(a), 142(3)(b)
F2 Words in s. 62(3)(a) omitted (19.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 82(b), 142(3)(b)
F3 Word in s. 62(5) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

I1 S. 62 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-62.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.