Section 93Right to information

(1) The controller must give a data subject the following information—

(a)
the identity and the contact details of the controller;
(b)
the legal basis on which, and the purposes for which, the controller processes personal data;
(c)
the categories of personal data relating to the data subject that are being processed;
(d)
the recipients or the categories of recipients of the personal data (if applicable);
(e)
the right to lodge a complaint with the [^F1Commission] [^F2under section 165] and the contact details of the [^F1Commission];
(f)
how to exercise rights under this Chapter;
(g)
any other information needed to secure that the personal data is processed fairly and transparently.

(2) The controller may comply with subsection (1) by making information generally available, where the controller considers it appropriate to do so.

(3) The controller is not required under subsection (1) to give a data subject information that the data subject already has.

(4) Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in subsection (1) has effect, in relation to the personal data so collected, with the following exceptions—

(a)
the requirement does not apply in relation to processing that is authorised by an enactment;
(b)
the requirement does not apply in relation to the data subject if giving the information to the data subject would be impossible or involve disproportionate effort.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Word in s. 93(1)(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F2 Words in s. 93(1)(e) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 14; S.I. 2026/82, reg. 3(b) (with reg. 7)

Commencement Information

I1 S. 93 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(a)

https://dpa2018.digiphile.law/article/article-93.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.