Part III Notification by data controllers

24 Duty of certain data controllers to make certain information available.

1

Subject to subsection (3), where personal data are processed in a case where—

a

by virtue of subsection (2) or (3) of section 17, subsection (1) of that section does not apply to the processing, and

b

the data controller has not notified the relevant particulars in respect of that processing under section 18,

the data controller must, within twenty-one days of receiving a written request from any person, make the relevant particulars available to that person in writing free of charge.

2

In this section “the relevant particulars” means the particulars referred to in paragraphs (a) to (f) of section 16(1).

3

This section has effect subject to any exemption conferred for the purposes of this section by notification regulations.

4

Any data controller who fails to comply with the duty imposed by subsection (1) is guilty of an offence.

5

It shall be a defence for a person charged with an offence under subsection (4) to show that he exercised all due diligence to comply with the duty.