- Latest available (Revised)
- Original (As enacted)
There are outstanding changes not yet made by the legislation.gov.uk editorial team to Data Protection Act 1998. Any changes that have already been made by the team appear in the content and are referenced with annotations.
Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.
This section lists the changes and effects yet to be applied to the whole Act, associated Parts and Chapters where applicable. This includes any insertions of whole new Parts, Chapters or provisions yet to be inserted into this Act. These effects are included in this view as they may be (but won’t necessarily be) relevant to the specific provision that you are viewing.
This section lists the commencement orders yet to be applied to the whole Act. These effects are included in this view as they may be (but won’t necessarily be) relevant to the specific provision that you are viewing. Where applicable the commencement orders are listed under two headings, firstly those that bring some part of the Act you are viewing into force and secondly, those that bring into force legislation that affects some part of the legislation you are viewing. If you are viewing a prospective version or there is a prospective version available there may be commencement orders listed here that are relevant to the provision you are viewing.
Annotations are used to give authority for changes and other effects on the legislation you are viewing and to convey editorial information. They appear at the foot of the relevant provision or under the associated heading. Annotations are categorised by annotation type, such as F-notes for textual amendments and I-notes for commencement information (a full list can be found in the Editorial Practice Guide). Each annotation is identified by a sequential reference number. For F-notes, M-notes and X-notes, the number also appears in bold superscript at the relevant location in the text. All annotations contain links to the affecting legislation.
(1)The Commissioner may serve a data controller within subsection (2) with a notice (in this Act referred to as an “assessment notice”) for the purpose of enabling the Commissioner to determine whether the data controller has complied or is complying with the data protection principles.
(2)A data controller is within this subsection if the data controller is—
(a)a government department,
(b)a public authority designated for the purposes of this section by an order made by the Secretary of State, or
(c)a person of a description designated for the purposes of this section by such an order.
(3)An assessment notice is a notice which requires the data controller to do all or any of the following—
(a)permit the Commissioner to enter any specified premises;
(b)direct the Commissioner to any documents on the premises that are of a specified description;
(c)assist the Commissioner to view any information of a specified description that is capable of being viewed using equipment on the premises;
(d)comply with any request from the Commissioner for—
(i)a copy of any of the documents to which the Commissioner is directed;
(ii)a copy (in such form as may be requested) of any of the information which the Commissioner is assisted to view;
(e)direct the Commissioner to any equipment or other material on the premises which is of a specified description;
(f)permit the Commissioner to inspect or examine any of the documents, information, equipment or material to which the Commissioner is directed or which the Commissioner is assisted to view;
(g)permit the Commissioner to observe the processing of any personal data that takes place on the premises;
(h)make available for interview by the Commissioner a specified number of persons of a specified description who process personal data on behalf of the data controller (or such number as are willing to be interviewed).
(4)In subsection (3) references to the Commissioner include references to the Commissioner's officers and staff.
(5)An assessment notice must, in relation to each requirement imposed by the notice, specify—
(a)the time at which the requirement is to be complied with, or
(b)the period during which the requirement is to be complied with.
(6)An assessment notice must also contain particulars of the rights of appeal conferred by section 48.
(7)The Commissioner may cancel an assessment notice by written notice to the data controller on whom it was served.
(8)Where a public authority has been designated by an order under subsection (2)(b) the Secretary of State must reconsider, at intervals of no greater than 5 years, whether it continues to be appropriate for the authority to be designated.
(9)The Secretary of State may not make an order under subsection (2)(c) which designates a description of persons unless—
(a)the Commissioner has made a recommendation that the description be designated, and
(b)the Secretary of State has consulted—
(i)such persons as appear to the Secretary of State to represent the interests of those that meet the description;
(ii)such other persons as the Secretary of State considers appropriate.
(10)The Secretary of State may not make an order under subsection (2)(c), and the Commissioner may not make a recommendation under subsection (9)(a), unless the Secretary of State or (as the case may be) the Commissioner is satisfied that it is necessary for the description of persons in question to be designated having regard to—
(a)the nature and quantity of data under the control of such persons, and
(b)any damage or distress which may be caused by a contravention by such persons of the data protection principles.
(11)Where a description of persons has been designated by an order under subsection (2)(c) the Secretary of State must reconsider, at intervals of no greater than 5 years, whether it continues to be necessary for the description to be designated having regard to the matters mentioned in subsection (10).
(12)In this section—
“” includes any body, office-holder or other person in respect of which—
an order may be made under section 4 or 5 of the Freedom of Information Act 2000, or
an order may be made under section 4 or 5 of the Freedom of Information (Scotland) Act 2002;
“specified” means specified in an assessment notice.]
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
Would you like to continue?
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made):The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include: