- Section 43Overview and scope
(1) This Chapter— (a) imposes general duties on the controller to make information available (see sections 44 and 45A ); (b) confers a right of access by the…
- Section 44... Controller's general duties
(1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)— (a)…
- Section 45Right of access by the data subject
(1) A data subject is entitled to obtain from the controller— (a) confirmation as to whether or not personal data concerning him or her is being processed, and…
- Section 45AExemption from sections 44 and 45: legal professional privilege
(1) Sections 44(2) and 45(1) do not require the controller to give the data subject— (a) information in respect of which a claim to legal professional privilege or,…
- Section 46Right to rectification
(1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject. (2) Where personal data is…
- Section 47Right to erasure or restriction of processing
(1) The controller must erase personal data without undue delay where— (a) the processing of the personal data would infringe section 35 , 36(1) to (3) , 37…
- Section 48Rights under section 46 or 47: supplementary
(1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—…
- Section 49Right not to be subject to automated decision-making
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 50Automated decision-making authorised by law: safeguards
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
- Section 50AAutomated processing and significant decisions
(1) For the purposes of sections 50B and 50C — (a) a decision is based solely on automated processing if there is no meaningful human involvement in the…
- Section 50BRestrictions on automated decision-making based on sensitive processing
(1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.…
- Section 50CSafeguards for automated decision-making
(1) Subject to subsection (3) , where a significant decision taken by or on behalf of a controller in relation to a data subject is— (a) based entirely…
- Section 50DFurther provision about automated decision-making
(1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1) (a) and 50C(3) (c), there is, or is not, to be taken…
- Section 51Exercise of rights through the Commission
(1) This section applies where a controller— (a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give…
- Section 52Form of provision of information etc
(1) The controller must take reasonable steps to ensure that any information that is required by or under this Chapter to be provided to the data subject is…
- Section 53Manifestly unfounded or excessive requests by the data subject
(1) Where a request made by a data subject under or by virtue of any of sections 45 , 46 , 47 , 50C or 50D is manifestly…
- Section 54Meaning of “applicable time period”
(1) This section defines “the applicable time period” for the purposes of sections 45(3) (b) and (5) , 48(2)(b) and 53(7). (2) “The applicable time period” means the…
https://dpa2018.digiphile.law/part/part-3-chapter-3.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.