Part 7Supplementary and final provision

Regulations under this Act

Section 182Regulations and consultation
(1) Regulations under this Act are to be made by statutory instrument. (2) Before making regulations under this Act, the Secretary of State must consult— (a) the Commission,…

Changes to the Data Protection Convention

Section 183Power to reflect changes to the Data Protection Convention
(1) The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment of, or an…

Prohibitions and restrictions etc on processing

Section 183AProtection of prohibitions and restrictions etc on processing: relevant enactments
(1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main…
Section 183BProtection of prohibitions and restrictions etc on processing: other enactments
(1) This section is about the relationship between— (a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and (b) a provision…

Rights of the data subject

Section 184Prohibition of requirement to produce relevant records
(1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with—…
Section 185Avoidance of certain contractual terms relating to health records
(1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which—…
Section 186Protection of data subject’s rights
(1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and…
Section 186AProtection of data subject’s rights: further provision
(1) This section is about the relationship between— (a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and (b)…

Representation of data subjects

Section 187Representation of data subjects with their authority
(1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)— (a) ... enables…
Section 188Representation of data subjects with their authority: collective proceedings
(1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland…
Section 189Duty to review provision for representation of data subjects
(1) Before the end of the review period, the Secretary of State must— (a) review the matters listed in subsection (2) in relation to England and Wales and…
Section 190Post-review powers to make provision about representation of data subjects
(1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations— (a) exercise the powers under Article 80(2) of the UK…

Framework for Data Processing by Government

Section 191Framework for Data Processing by Government
(1) The Secretary of State may prepare a document, called the Framework for Data Processing by Government, which contains guidance about the processing of personal data in connection…
Section 192Approval of the Framework
(1) Before issuing a document prepared under section 191 , the Secretary of State must lay it before Parliament. (2) If, within the 40-day period, either House of…
Section 193Publication and review of the Framework
(1) The Secretary of State must publish a document issued under section 192(3) . (2) Where an amendment of a document is issued under section 192(3) , the…
Section 194Effect of the Framework
(1) When carrying out processing of personal data which is the subject of a document issued under section 192(3) which is for the time being in force, a…

Section 195Reserve forces: data-sharing by HMRC
(1) The Reserve Forces Act 1996 is amended as follows. (2) After section 125 insert— “ 125A Supply of contact details by HMRC (1) This subsection applies to…

Offences

Section 196Penalties for offences
(1) A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable— (a) on summary conviction in England and Wales,…
Section 197Prosecution
(1) In England and Wales, proceedings for an offence under this Act may be instituted only— (a) by the Commission, or (b) by or with the consent of…
Section 198Liability of directors etc
(1) Subsection (2) applies where— (a) an offence under this Act has been committed by a body corporate, and (b) it is proved to have been committed with…
Section 199Recordable offences
(1) . . . . . . . . . . . . . . . . . . . . . . . . . . .…
Section 200Guidance about PACE codes of practice
(1) The Commission must produce and publish guidance about how the Commission proposes to perform the duty under section 67(9) of the Police and Criminal Evidence Act 1984…

The Tribunal

Section 201Disclosure of information to the Tribunal
(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information…
Section 202Proceedings in the First-tier Tribunal: contempt
(1) This section applies where— (a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal— (i) on an appeal under…
Section 203Tribunal Procedure Rules
(1) Tribunal Procedure Rules may make provision for regulating— (a) the exercise of the rights of appeal conferred by section 27 , 79 , 82E , 111 or…

Interpretation

Section 204Meaning of “health professional” and “social work professional”
(1) In this Act, “health professional” means any of the following— (a) a registered medical practitioner; (b) a registered nurse or midwife; (c) a registered dentist within the…
Section 205General interpretation
(1) In this Act— “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or…
Section 206Index of defined expressions
The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of…

Territorial application

Section 207Territorial application of this Act
(1) This Act applies only to processing of personal data described in subsections (1A) and (2). (1A) In the case of the processing of personal data to which…

General

Section 208Children in Scotland
(1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to— (a)…
Section 209Application to the Crown
(1) This Act binds the Crown. (2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate…
Section 210Application to Parliament
(1) Parts 1 , 2 and 5 to 7 of this Act apply to the processing of personal data by or on behalf of either House of Parliament.…
Section 211Minor and consequential provision
(1) In Schedule 19 — (a) Part 1 contains minor and consequential amendments of primary legislation; (b) Part 2 contains minor and consequential amendments of other legislation; (c)…

Final

Section 212Commencement
(1) Except as provided by subsections (2) and (3) , this Act comes into force on such day as the Secretary of State may by regulations appoint. (2)…
Section 213Transitional provision
(1) Schedule 20 contains transitional, transitory and saving provision. (2) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming…
Section 214Extent
(1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to— (a) subsections (2) to (5) , ... (b) . . . . . .…
Section 215Short title
This Act may be cited as the Data Protection Act 2018.

https://dpa2018.digiphile.law/part/part-7.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.