- Latest available (Revised)
- Original (As enacted)
Data Protection Act 2018, Cross Heading: Representation of data subjects is up to date with all changes known to be in force on or before 07 November 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.
Whole provisions yet to be inserted into this Act (including any effects on those provisions):
(1)In relation to the processing of personal data to which the [F1UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)]—
(a)F2... enables a data subject to authorise a body or other organisation which meets the conditions set out in [F3subsections (3) and (4)] to exercise the data subject's rights under Articles 77, 78 and 79 of the [F4UK GDPR] (rights to lodge complaints and to an effective judicial remedy) on the data subject's behalf, and
(b)[F5also authorises] such a body or organisation to exercise the data subject's rights under Article 82 of the [F6UK GDPR] (right to compensation).
(2)In relation to the processing of personal data to which the [F7UK GDPR] does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf—
(a)rights under section 165(2) [F8and (4)(d)] (complaints to the Commissioner);
(b)rights under section 166(2) (orders for the Commissioner to progress complaints);
(c)rights under section 167(1) (compliance orders);
(d)the right to bring judicial review proceedings against the Commissioner.
(3)The first condition is that the body or organisation, by virtue of its constitution or an enactment—
(a)is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,
(b)is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and
(c)has objectives which are in the public interest.
(4)The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data.
(5)In this Act, references to a “representative body”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the [F9UK GDPR] or this section.
Textual Amendments
F1Words in s. 187(1) substituted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F2Words in s. 187(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F3Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F4Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F5Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F6Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F7Words in s. 187(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F8Words in s. 187(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F9Words in s. 187(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.
(2)In this section, “relevant claim”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject's behalf under Article 80(1) of the [F10UK GDPR] or section 187.
(3)The power under subsection (1) includes power—
(a)to make provision about the proceedings;
(b)to confer functions on a person, including functions involving the exercise of a discretion;
(c)to make different provision in relation to England and Wales and in relation to Northern Ireland.
(4)The provision mentioned in subsection (3)(a) includes provision about—
(a)the effect of judgments and orders;
(b)agreements to settle claims;
(c)the assessment of the amount of compensation;
(d)the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
(e)costs.
(5)Regulations under this section are subject to the negative resolution procedure.
Textual Amendments
F10Words in s. 188(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 82 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I1S. 188 in force at Royal Assent for specified purposes, see s. 212(2)(f)
I2S. 188 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(e)
(1)Before the end of the review period, the Secretary of State must—
(a)review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,
(b)prepare a report of the review, and
(c)lay a copy of the report before Parliament.
(2)Those matters are—
(a)the operation of Article 80(1) of the [F11UK GDPR],
(b)the operation of section 187,
(c)the merits of exercising the power under Article 80(2) of the [F11UK GDPR] (power to enable a body or other organisation which meets the conditions in Article 80(1) of the [F11UK GDPR] to exercise some or all of a data subject's rights under Articles 77, 78 and 79 of the [F11UK GDPR] without being authorised to do so by the data subject),
(d)the merits of making equivalent provision in relation to data subjects' rights under Article 82 of the [F11UK GDPR] (right to compensation), and
(e)the merits of making provision for a children's rights organisation to exercise some or all of a data subject's rights under Articles 77, 78, 79 and 82 of the [F11UK GDPR] on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.
(3)“The review period” is the period of 30 months beginning when section 187 comes into force.
(4)In carrying out the review, the Secretary of State must—
(a)consider the particular needs of children separately from the needs of adults,
(b)have regard to the fact that children have different needs at different stages of development,
(c)carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the [F12UK GDPR] or section 187,
(d)consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the [F13UK GDPR] by another person on their behalf and the merits of making available other support or advice, and
(e)have regard to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.
(5)Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—
(a)persons active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data,
(b)children and parents,
(c)children's rights organisations and other persons who appear to the Secretary of State to represent the interests of children,
(d)child development experts, and
(e)trade associations.
(6)In this section—
“children's rights organisation” means a body or other organisation which—
is active in representing the interests of children, and
has objectives which are in the public interest;
“trade association” includes a body representing controllers or processors;
“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.
Textual Amendments
F11Words in s. 189(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F12Words in s. 189(4)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F13Words in s. 189(4)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I3S. 189 in force at 23.7.2018 by S.I. 2018/625, reg. 3(f)
(1)After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—
(a)exercise the powers under Article 80(2) of the [F14UK GDPR] in relation to England and Wales and Northern Ireland,
(b)make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the [F14UK GDPR] to exercise a data subject's rights under Article 82 of the [F14UK GDPR] in England and Wales and Northern Ireland without being authorised to do so by the data subject, and
(c)make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.
(2)The powers under subsection (1) include power—
(a)to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject's rights;
(b)to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject's rights;
(c)to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;
(d)to confer functions on a person, including functions involving the exercise of a discretion;
(e)to amend sections 166 to 168, 180, 187, 203, 205 and 206;
(f)to insert new sections and Schedules into Part 6 or 7 ;
(g)to make different provision in relation to England and Wales and in relation to Northern Ireland.
(3)The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.
(4)The provision mentioned in subsection (2)(b) and (c) includes provision about—
(a)the effect of judgments and orders;
(b)agreements to settle claims;
(c)the assessment of the amount of compensation;
(d)the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
(e)costs.
(5)Regulations under this section are subject to the affirmative resolution procedure.
Textual Amendments
F14Words in s. 190(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 84 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I4S. 190 in force at Royal Assent for specified purposes, see s. 212(2)(f)
I5S. 190 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(g)
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Text created by the government department responsible for the subject matter of the Act to explain what the Act sets out to achieve and to make the Act accessible to readers who are not legally qualified. Explanatory Notes were introduced in 1999 and accompany all Public Acts except Appropriation, Consolidated Fund, Finance and Consolidation Acts.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: