Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 71A – Codes of conduct

Sections

Section 71A[F1Codes of conduct

(1) The [F2Commission] must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.
(2) Under subsection (1), the [F2Commission] must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.
(3) For the purposes of this section—
  • (a)
    “public body” means a body or other person whose functions are, or include, functions of a public nature, and
  • (b)
    a public body is “expert” if, in the [F3Commission's] opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).
(4) A code of conduct described in subsection (1) may, for example, make provision with regard to—
  • (a)
    lawful and fair processing;
  • (b)
    the collection of personal data;
  • (c)
    the information provided to the public and to data subjects;
  • (d)
    the exercise of the rights of data subjects;
  • (e)
    the measures and procedures referred to in sections 56, 57 and 62;
  • (f)
    the notification of personal data breaches to the [F4Commission] and the communication of personal data breaches to data subjects;
  • (g)
    the transfer of personal data to third countries or international organisations;
  • (h)
    out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.
(5) The [F5Commission] must encourage expert public bodies to submit codes of conduct described in subsection (1) to the [F5Commission] in draft.
(6) Where an expert public body does so, the [F5Commission] must—
  • (a)
    provide the body with an opinion on whether the code correctly reflects the requirements of this Part,
  • (b)
    decide whether to approve the code, and
  • (c)
    if the code is approved, register and publish the code.
(7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.]

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 S. 71A and cross-heading inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 84(6), 142(1); S.I. 2025/904, reg. 2(d)
  2. F2 Word in s. 71A(1)(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  3. F3 Word in s. 71A(3)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  4. F4 Word in s. 71A(4)(f) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  5. F5 Word in s. 71A(5)(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

https://dpa2018.digiphile.law/article/article-71A.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.