Part 5The Information Commission

...

Section 114The Information Commissioner
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…

The Information Commission

Section 114AThe Information Commission
(1) A body corporate called the Information Commission is established. (2) Schedule 12A makes further provision about the Commission.

General functions

Section 115General functions under the UK GDPR and safeguards
(1) . . . . . . . . . . . . . . . . . . . . . . . . . . .…
Section 116Other general functions
(A1) The Commission is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals in relation…
Section 117Competence in relation to courts etc
Nothing in this Act or the UK GDPR permits or requires the Commission to exercise functions in relation to the processing of personal data by— (a) an individual…

International role

Section 118Co-operation between parties to the Data Protection Convention
(1) . . . . . . . . . . . . . . . . . . . . . . . . . . .…
Section 119Inspection of personal data in accordance with international obligations
(1) The Commission may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in…
Section 119AStandard clauses for transfers to third countries etc
(1) The Commission may issue a document specifying standard data protection clauses which the Commission considers are capable of securing that the data protection test set out in…
Section 120Further international role
(1) The Commission must, in relation to third countries and international organisations, take appropriate steps to— (a) develop international co-operation mechanisms to facilitate the effective enforcement of legislation…

Duties in carrying out functions

Section 120APrincipal objective
It is the principal objective of the Commission, in carrying out functions under the data protection legislation— (a) to secure an appropriate level of protection for personal data,…
Section 120BDuties in relation to functions under the data protection legislation
In carrying out functions under the data protection legislation, the Commission must have regard to such of the following as appear to the Commission to be relevant in…
Section 120CStrategy
(1) The Commission must prepare a strategy for carrying out the Commission's functions under the data protection legislation in accordance with the Commission's duties under— (a) sections 120A…
Section 120DDuty to consult other regulators
(1) The Commission must, at such times as the Commission considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commission exercises…

Codes of practice

Section 121Data-sharing code
(1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the sharing of personal data in accordance with the requirements of…
Section 122Direct marketing code
(1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the carrying out of direct marketing in accordance with the requirements…
Section 123Age-appropriate design code
(1) The Commission must prepare a code of practice which contains such guidance as the Commission considers appropriate on standards of age-appropriate design of relevant information society services…
Section 124Data protection and journalism code
(1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the processing of personal data for the purposes of journalism in…
Section 124AOther codes of practice
(1) The Commission must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations…
Section 124BPanels to consider codes of practice
(1) This section applies where a code is prepared under section 121 , 122 , 123 , 124 or 124A , subject to subsection (11) . (2) The…
Section 124CImpact assessments for codes of practice
(1) Where a code is prepared under section 121 , 122 , 123 , 124 or 124A , the Commission must carry out and publish an assessment of—…
Section 125Approval of codes prepared under sections 121 to 124A
(1) When a code is prepared under section 121 , 122 , 123 , 124 or 124A— (a) the Commission must submit the final version to the Secretary…
Section 126Publication and review of codes issued under section 125(4)
(1) The Commission must publish a code issued under section 125(4) . (2) Where an amendment of a code is issued under section 125(4) , the Commission must…
Section 127Effect of codes issued under section 125(4)
(1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable…
Section 128Other codes of practice
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…

Consensual audits

Section 129Consensual audits
(1) The Commission's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent of a controller or processor, to…

Records of national security certificates

Section 130Records of national security certificates
(1) A Minister of the Crown who issues a certificate under section 27 , 79 or 111 must send a copy of the certificate to the Commission. (2)…

Information provided to the Commission

Section 131Disclosure of information to the Commission
(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commission with information necessary for the discharge of…
Section 132Confidentiality of information
(1) A person who is or has been a member of the Commission or a member of its staff, or an agent of the Commission, must not disclose…
Section 133Guidance about privileged communications
(1) The Commission must produce and publish guidance about— (a) how the Commission proposes to secure that privileged communications which the Commission obtains or has access to in…

Fees

Section 134Fees for services
The Commission may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person,…
Section 135Manifestly unfounded or excessive requests by data subjects etc
(A1) This section makes provision about cases in which a request made to the Commission, to which the Commission is required or authorised to respond under the data…
Section 136Guidance about fees
(1) The Commission must produce and publish guidance about the fees the Commission proposes to charge in accordance with— (a) section 134 or 135 , ... (b) .…

Charges

Section 137Charges payable to the Commission by controllers
(1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commission. (2) Regulations under subsection (1)…
Section 138Regulations under section 137: supplementary
(1) Before making regulations under section 137(1) or (6) , the Secretary of State must consult such representatives of persons likely to be affected by the regulations as…

Reports etc

Section 139Reporting to Parliament
(1) The Commission must— (a) produce a general report on the carrying out of the Commission's functions annually, (b) arrange for it to be laid before Parliament, and…
Section 139AAnalysis of performance
(1) The Commission must prepare and publish an analysis of the Commissioner’s performance using key performance indicators. (2) The analysis must be prepared and published at least annually.…

Documents and notices

Section 140Publication by the Commission
A duty under this Act for the Commission to publish a document is a duty for the Commission to publish it, or to arrange for it to be…
Section 141Notices from the Commissioner
. . . . . . . . . . . . . . . . . . . . . . . . . . . .…
Section 141ANotices from the Commission
(1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commission. (2) The notice may…

https://dpa2018.digiphile.law/part/part-5.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.