Data Protection Act 1998

Part IPreliminary

1Basic interpretative provisions

2Sensitive personal data

3The special purposes

4The data protection principles

5Application of Act

6The Commissioner and the Tribunal

Part IIRights of data subjects and others

7Right of access to personal data

8Provisions supplementary to section 7

9Application of section 7 where data controller is credit reference agency

10Right to prevent processing likely to cause damage or distress

11Right to prevent processing for purposes of direct marketing

12Rights in relation to automated decision-taking

13Compensation for failure to comply with certain requirements

14Rectification, blocking, erasure and destruction

15Jurisdiction and procedure

Part IIINotification by data controllers

17Prohibition on processing without registration

18Notification by data controllers

19Register of notifications

20Duty to notify changes

22Preliminary assessment by Commissioner

23Power to make provision for appointment of data protection supervisors

24Duty of certain data controllers to make certain information available

25Functions of Commissioner in relation to making of notification regulations

26Fees regulations

Part IVExemptions

28National security

29Crime and taxation

30Health, education and social work

31Regulatory activity

32Journalism, literature and art

33Research, history and statistics

34Information available to the public by or under enactment

35Disclosures required by law or made in connection with legal proceedings etc

36Domestic purposes

37Miscellaneous exemptions

38Powers to make further exemptions by order

39Transitional relief

Part VEnforcement

40Enforcement notices

41Cancellation of enforcement notice

42Request for assessment

43Information notices

44Special information notices

45Determination by Commissioner as to the special purposes

46Restriction on enforcement in case of processing for the special purposes

47Failure to comply with notice

48Rights of appeal

49Determination of appeals

50Powers of entry and inspection

Part VIMiscellaneous and General

Functions of Commissioner

51General duties of Commissioner

52Reports and codes of practice to be laid before Parliament

53Assistance by Commissioner in cases involving processing for the special purposes

54International co-operation

Unlawful obtaining etc. of personal data

55Unlawful obtaining etc. of personal data

Records obtained under data subject’s right of access

56Prohibition of requirement as to production of certain records

57Avoidance of certain contractual terms relating to health records

Information provided to Commissioner or Tribunal

58Disclosure of information

59Confidentiality of information

General provisions relating to offences

60Prosecutions and penalties

61Liability of directors etc

Amendments of Consumer Credit Act 1974

62Amendments of Consumer Credit Act 1974

63Application to Crown

64Transmission of notices etc. by electronic or other means

65Service of notices by Commissioner

66Exercise of rights in Scotland by children

67Orders, regulations and rules

68Meaning of “accessible record”

69Meaning of “health professional”

70Supplementary definitions

71Index of defined expressions

72Modifications of Act

73Transitional provisions and savings

74Minor and consequential amendments and repeals and revocations

75Short title, commencement and extent

SCHEDULE 1The data protection principles

Part IThe principles

1Personal data shall be processed fairly and lawfully and, in...

2Personal data shall be obtained only for one or more...

3Personal data shall be adequate, relevant and not excessive in...

4Personal data shall be accurate and, where necessary, kept up...

5Personal data processed for any purpose or purposes shall not...

6Personal data shall be processed in accordance with the rights...

7Appropriate technical and organisational measures shall be taken against unauthorised...

8Personal data shall not be transferred to a country or...

Part IIInterpretation of the principles in Part I

The first principle

1(1) In determining for the purposes of the first principle...

2(1) Subject to paragraph 3, for the purposes of the...

3(1) Paragraph 2(1)(b) does not apply where either of the...

4(1) Personal data which contain a general identifier falling within...

The second principle

5The purpose or purposes for which personal data are obtained...

6In determining whether any disclosure of personal data is compatible...

The fourth principle

7The fourth principle is not to be regarded as being...

The sixth principle

8A person is to be regarded as contravening the sixth...

The seventh principle

9Having regard to the state of technological development and the...

10The data controller must take reasonable steps to ensure the...

11Where processing of personal data is carried out by a...

12Where processing of personal data is carried out by a...

The eighth principle

13An adequate level of protection is one which is adequate...

14The eighth principle does not apply to a transfer falling...

15(1) Where— (a) in any proceedings under this Act any...

SCHEDULE 2Conditions relevant for purposes of the first principle: processing of any personal data

1The data subject has given his consent to the processing....

2The processing is necessary— (a) for the performance of a...

3The processing is necessary for compliance with any legal obligation...

4The processing is necessary in order to protect the vital...

5The processing is necessary— (a) for the administration of justice,...

6(1) The processing is necessary for the purposes of legitimate...

SCHEDULE 3Conditions relevant for purposes of the first principle: processing of sensitive personal data

1The data subject has given his explicit consent to the...

2(1) The processing is necessary for the purposes of exercising...

3The processing is necessary— (a) in order to protect the...

4The processing— (a) is carried out in the course of...

5The information contained in the personal data has been made...

6The processing— (a) is necessary for the purpose of, or...

7(1) The processing is necessary— (a) for the administration of...

8(1) The processing is necessary for medical purposes and is...

9(1) The processing— (a) is of sensitive personal data consisting...

10The personal data are processed in circumstances specified in an...

SCHEDULE 4Cases where the eighth principle does not apply

1The data subject has given his consent to the transfer....

2The transfer is necessary— (a) for the performance of a...

3The transfer is necessary— (a) for the conclusion of a...

4(1) The transfer is necessary for reasons of substantial public...

5The transfer— (a) is necessary for the purpose of, or...

6The transfer is necessary in order to protect the vital...

7The transfer is of part of the personal data on...

8The transfer is made on terms which are of a...

9The transfer has been authorised by the Commissioner as being...

SCHEDULE 5The Data Protection Commissioner and the Data Protection Tribunal

Part IThe Commissioner

Status and capacity

1(1) The corporation sole by the name of the Data...

Tenure of office

2(1) Subject to the provisions of this paragraph, the Commissioner...

3(1) There shall be paid— (a) to the Commissioner such...

Officers and staff

4(1) The Commissioner— (a) shall appoint a deputy commissioner, and...

5(1) The deputy commissioner shall perform the functions conferred by...

Authentication of seal of the Commissioner

6The application of the seal of the Commissioner shall be...

Presumption of authenticity of documents issued by the Commissioner

7Any document purporting to be an instrument issued by the...

8The Secretary of State may make payments to the Commissioner...

9(1) All fees and other sums received by the Commissioner...

10(1) It shall be the duty of the Commissioner—

Application of Part I in Scotland

11Paragraphs 1(1), 6 and 7 do not extend to Scotland....

Part IIThe Tribunal

Tenure of office

12(1) Subject to the following provisions of this paragraph, a...

13The Secretary of State shall pay to the members of...

Officers and staff

14The Secretary of State may provide the Tribunal with such...

15Such expenses of the Tribunal as the Secretary of State...

Part IIITransitional provisions

16Any reference in any enactment, instrument or other document to...

17Any reference in this Act or in any instrument under...

SCHEDULE 6Appeal proceedings

Hearing of appeals

1For the purpose of hearing and determining appeals or any...

Constitution of Tribunal in national security cases

2(1) The Lord Chancellor shall from time to time designate,...

3In any case where the application of paragraph 6(1) is...

Constitution of Tribunal in other cases

4(1) Subject to any rules made under paragraph 7, the...

Determination of questions by full Tribunal

5The determination of any question before the Tribunal when constituted...

Ex parte proceedings

6(1) Subject to any rules made under paragraph 7, the...

Rules of procedure

7(1) The Secretary of State may make rules for regulating...

Obstruction etc.

8(1) If any person is guilty of any act or...

SCHEDULE 7Miscellaneous exemptions

Confidential references given by the data controller

1Personal data are exempt from section 7 if they consist...

2Personal data are exempt from the subject information provisions in...

Judicial appointments and honours

3Personal data processed for the purposes of—

Crown employment and Crown or Ministerial appointments

4The Secretary of State may by order exempt from the...

Management forecasts etc.

5Personal data processed for the purposes of management forecasting or...

Corporate finance

6(1) Where personal data are processed for the purposes of,...

7Personal data which consist of records of the intentions of...

Examination marks

8(1) Section 7 shall have effect subject to the provisions...

Examination scripts etc.

9(1) Personal data consisting of information recorded by candidates during...

Legal professional privilege

10Personal data are exempt from the subject information provisions if...

Self-incrimination

11(1) A person need not comply with any request or...

SCHEDULE 8Transitional relief

Part IInterpretation of Schedule

1(1) For the purposes of this Schedule, personal data are...

Part IIExemptions available before 24th October 2001

2(1) Eligible manual data, other than data forming part of...

3(1) This paragraph applies to— (a) eligible manual data forming...

4(1) This paragraph applies to eligible manual data which consist...

Processing otherwise than by reference to the data subject

5During the first transitional period, for the purposes of this...

Payrolls and accounts

6(1) Subject to sub-paragraph (2), eligible automated data processed by...

Unincorporated members' clubs and mailing lists

7Eligible automated data processed by an unincorporated members' club and...

8Eligible automated data processed by a data controller only for...

9Neither paragraph 7 nor paragraph 8 applies to personal data...

10It shall be a condition of the exemption of any...

11Data to which paragraph 10 applies may be disclosed—

12Eligible automated data which are processed only for the purpose...

Exemption of all eligible automated data from certain requirements

13(1) During the first transitional period, eligible automated data are...

Part IIIExemptions available after 23rd October 2001 but before 24th October 2007

14(1) This paragraph applies to— (a) eligible manual data which...

Part IVExemptions after 23rd October 2001 for historical research

15In this Part of this Schedule “the relevant conditions” has...

16(1) Eligible manual data which are processed only for the...

17(1) After 23rd October 2001 eligible automated data which are...

18For the purposes of this Part of this Schedule personal...

Part VExemption from section 22

19Processing which was already under way immediately before 24th October...

SCHEDULE 9Powers of entry and inspection

Issue of warrants

1(1) If a circuit judge is satisfied by information on...

2(1) A judge shall not issue a warrant under this...

3A judge who issues a warrant under this Schedule shall...

Execution of warrants

4A person executing a warrant issued under this Schedule may...

5A warrant issued under this Schedule shall be executed at...

6If the person who occupies the premises in respect of...

7(1) A person seizing anything in pursuance of a warrant...

Matters exempt from inspection and seizure

8The powers of inspection and seizure conferred by a warrant...

9(1) Subject to the provisions of this paragraph, the powers...

10If the person in occupation of any premises in respect...

Return of warrants

11A warrant issued under this Schedule shall be returned to...

12Any person who— (a) intentionally obstructs a person in the...

Vessels, vehicles etc.

13In this Schedule “premises” includes any vessel, vehicle, aircraft or...

Scotland and Northern Ireland

14In the application of this Schedule to Scotland—

15In the application of this Schedule to Northern Ireland—

SCHEDULE 10Further provisions relating to assistance under section 53

1In this Schedule “applicant” and “proceedings” have the same meaning...

2The assistance provided under section 53 may include the making...

3Where assistance is provided with respect to the conduct of...

4Where the Commissioner provides assistance in relation to any proceedings,...

5In England and Wales or Northern Ireland, the recovery of...

6In Scotland, the recovery of such expenses (as taxed or...

SCHEDULE 11Educational records

Meaning of “educational record”

1For the purposes of section 68 “educational record” means any...

England and Wales

2This paragraph applies to any record of information which—

3The schools referred to in paragraph 2(a) are—

4The persons referred to in paragraph 2(c) are—

5This paragraph applies to any record of information which is...

6For the purposes of paragraph 5— (a) “education authority” means...

Northern Ireland

7(1) This paragraph applies to any record of information which—...

8The persons referred to in paragraph 7(1) are—

England and Wales: transitory provisions

9(1) Until the appointed day within the meaning of section...

SCHEDULE 12Accessible public records

Meaning of “accessible public record”

1For the purposes of section 68 “accessible public record” means...

Housing and social services records: England and Wales

2The following is the Table referred to in paragraph 1(a)....

3(1) The following provisions apply for the interpretation of the...

Housing and social services records: Scotland

4The following is the Table referred to in paragraph 1(b)....

5(1) The following provisions apply for the interpretation of the...

Housing and social services records: Northern Ireland

6The following is the Table referred to in paragraph 1(c)....

7(1) This paragraph applies for the interpretation of the Table...

SCHEDULE 13Modifications of Act having effect before 24th October 2007

1After section 12 there is inserted— Rights of data subjects...

2In section 32— (a) in subsection (2) after “section 12”...

3In section 34 for “section 14(1) to (3)” there is...

4In section 53(1) after “12(8)” there is inserted “, 12A(3)”....

5In paragraph 8 of Part II of Schedule 1, the...

SCHEDULE 14Transitional provisions and savings

1In this Schedule— “the 1984 Act” means the Data Protection...

Effect of registration under Part II of 1984 Act

2(1) Subject to sub-paragraphs (4) and (5) any person who,...

Rights of data subjects

3(1) The repeal of section 21 of the 1984 Act...

4The repeal of section 22 of the 1984 Act (compensation...

5The repeal of section 24 of the 1984 Act (rectification...

6Subsection (3)(b) of section 14 does not apply where the...

Enforcement and transfer prohibition notices served under Part V of 1984 Act

7(1) If, immediately before the commencement of section 40—

8(1) If, immediately before the commencement of section 40—

Notices under new law relating to matters in relation to which 1984 Act had effect

9The Commissioner may serve an enforcement notice under section 40...

10Subsection (5)(b) of section 40 does not apply where the...

11The Commissioner may serve an information notice under section 43...

12Where by virtue of paragraph 11 an information notice is...

Self-incrimination, etc.

13(1) In section 43(8), section 44(9) and paragraph 11 of...

Warrants issued under 1984 Act

14The repeal of Schedule 4 to the 1984 Act does...

Complaints under section 36(2) of 1984 Act and requests for assessment under section 42

15The repeal of section 36(2) of the 1984 Act does...

16In dealing with a complaint under section 36(2) of the...

Applications under Access to Health Records Act 1990 or corresponding Northern Ireland legislation

17(1) The repeal of any provision of the Access to...

18(1) The revocation of any provision of the Access to...

Applications under regulations under Access to Personal Files Act 1987 or corresponding Northern Ireland legislation

19(1) The repeal of the personal files enactments does not...

Applications under section 158 of Consumer Credit Act 1974

20Section 62 does not affect the application of section 158...

SCHEDULE 15Minor and consequential amendments

Public Records Act 1958 (c. 51)

1(1) In Part II of the Table in paragraph 3...

Parliamentary Commissioner Act 1967 (c. 13)

2In Schedule 2 to the Parliamentary Commissioner Act 1967 (departments...

3In Schedule 4 to that Act (tribunals exercising administrative functions),...

Superannuation Act 1972 (c. 11)

4In Schedule 1 to the Superannuation Act 1972, for “Data...

House of Commons Disqualification Act 1975 (c. 24)

5(1) Part II of Schedule 1 to the House of...

Northern Ireland Assembly Disqualification Act 1975 (c. 25)

6(1) Part II of Schedule 1 to the Northern Ireland...

Representation of the People Act 1983 (c. 2)

7In Schedule 2 of the Representation of the People Act...

Access to Medical Reports Act 1988 (c. 28)

8In section 2(1) of the Access to Medical Reports Act...

Football Spectators Act 1989 (c. 37)

9(1) Section 5 of the Football Spectators Act 1989 (national...

Education (Student Loans) Act 1990 (c. 6)

10Schedule 2 to the Education (Student Loans) Act 1990 (loans...

Access to Health Records Act 1990 (c. 23)

11For section 2 of the Access to Health Records Act...

12In section 3(4) of that Act (cases where fee may...

13In section 5(3) of that Act (cases where right of...

Access to Personal Files and Medical Reports (Northern Ireland) Order 1991 (1991/1707 (N.I. 14))

14In Article 4 of the Access to Personal Files and...

15In Article 6(1) of that Order (interpretation), in the definition...

Tribunals and Inquiries Act 1992 (c. 53)

16In Part 1 of Schedule 1 to the Tribunals and...

Access to Health Records (Northern Ireland) Order 1993 (1993/1250 (N.I. 4))

17For paragraphs (1) and (2) of Article 4 of the...

18In Article 5(4) of that Order (cases where fee may...

19In Article 7 of that Order (cases where right of...

SCHEDULE 16Repeals and revocations

Part IIRevocations

Data Protection Act 1998

1998 Chapter 29

An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.

[16th July 1998]

Be it enacted by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—