Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Schedule 13 – Other general functions of the Commission

Schedules

Schedule 13Other general functions of the [F1Commission]Section 116

General tasks

1
(1) The [F2Commission] must—
  • (a)
    monitor and enforce Parts 3 and 4 of this Act;
  • (b)
    promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing of personal data to which those Parts apply;
  • (c)
    advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to processing of personal data to which those Parts apply;
  • (d)
    promote the awareness of controllers and processors of their obligations under Parts 3 and 4 of this Act;
  • (e)
    on request, provide information to a data subject concerning the exercise of the data subject's rights under Parts 3 and 4 of this Act and, if appropriate, co-operate with F3... foreign designated authorities to provide such information;
  • (f)
    co-operate with F4... foreign designated authorities with a view to ensuring the consistency of application and enforcement of F4... the Data Protection Convention, including by sharing information and providing mutual assistance;
  • (g)
    conduct investigations on the application of Parts 3 and 4 of this Act, including on the basis of information received from F5... a foreign designated authority or another public authority;
  • (h)
    monitor relevant developments to the extent that they have an impact on the protection of personal data, including the development of information and communication technologies;
  • (i)
    F6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) Section 3(14)(c) does not apply to the reference to personal data in sub-paragraph (1)(h).

General powers

2 The [F7Commission] has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4 of this Act applies—
  • (a)
    to notify the controller or the processor of an alleged infringement of Part 3 or 4 of this Act;
  • (b)
    to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of Part 3 or 4 of this Act;
  • (c)
    to issue reprimands to a controller or processor where processing operations have infringed provisions of Part 3 or 4 of this Act;
  • (d)
    to issue, on the [F7Commission's] own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.

Definitions

3 In this Schedule—
  • “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
  • F8...

Amended text

This Schedule is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Word in Sch. 13 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  2. F2 Word in Sch. 13 para. 1(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  3. F3 Words in Sch. 13 para. 1(1)(e) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Words in Sch. 13 para. 1(1)(f) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F5 Words in Sch. 13 para. 1(1)(g) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Sch. 13 para. 1(1)(i) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F7 Word in Sch. 13 para. 2 substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  8. F8 Words in Sch. 13 para. 3 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

  1. I1 Sch. 13 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)
  2. I2 Sch. 13 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)
  3. I3 Sch. 13 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

https://dpa2018.digiphile.law/schedule/schedule-13.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.