- Section 6Meaning of “controller”
(1) The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to— (a) subsection (2) , (b) section 209 , and (c) section 210…
- Section 7Meaning of “public authority” and “public body”
(1) For the purposes of the UK GDPR, the following (and only the following) are “public authorities” and “public bodies” ...— (a) a public authority as defined by…
- Section 8Lawfulness of processing: public interest etc
In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a…
- Section 9Child's consent in relation to information society services
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 9AProcessing in reliance on relevant international law
(1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international…
- Section 10Special categories of personal data and criminal convictions etc data
(1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of…
- Section 11Special categories of personal data etc: supplementary
(1) For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data…
- Section 12Limits on fees that may be charged by controllers
(1) The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on— (a) Article 12(5) of the UK GDPR…
- Section 13Obligations of credit reference agencies
(1) This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974 ). (2) The controller's…
- Section 13AMeaning of “relevant offence” for purpose of right to erasure
(1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR . (2) Regulations under this section are subject to the…
- Section 14Automated decision-making authorised by law: safeguards
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 15Exemptions etc
(1) Schedules 2 , 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR. (2) In Schedule…
- Section 16Power to make further exemptions etc by regulations
(1) The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of State under…
- Section 17Accreditation of certification providers
(1) Accreditation of a person as a certification provider is only valid when carried out by— (a) the Commission, or (b) the UK national accreditation body. (2) The…
- Section 17ATransfers based on adequacy regulations
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 17BTransfers based on adequacy regulations: review etc
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 17CStandard data protection clauses
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 18Transfers of personal data to third countries etc : public interest
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 19Processing for archiving, research and statistical purposes: safeguards
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 20Meaning of “court”
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
https://dpa2018.digiphile.law/part/part-2-chapter-2.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.