Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 65 – Prior consultation with the Commission

Sections

Section 65Prior consultation with the [F1Commission]

(1) This section applies where a controller intends to create a filing system and process personal data forming part of it.
(2) The controller must consult the [F2Commission] prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).
(3) Where the controller is required to consult the [F2Commission] under subsection (2), the controller must give the [F2Commission]—
  • (a)
    the data protection impact assessment prepared under section 64, and
  • (b)
    any other information requested by the [F2Commission] to enable the [F2Commission] to make an assessment of the compliance of the processing with the requirements of this Part.
(4) Where the [F2Commission] is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the [F2Commission] must provide written advice to the controller and, where the controller is using a processor, to the processor.
(5) The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.
(6) The [F3Commission] may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.
(7) If the [F3Commission] extends the period of 6 weeks, the [F3Commission] must—
  • (a)
    inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and
  • (b)
    provide reasons for the delay.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Word in s. 65 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  2. F2 Word in s. 65(2)-(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  3. F3 Word in s. 65(6)(7) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

  1. I1 S. 65 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-65.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.