Data Protection Act 2018 (c. 12)

PART 7 U.K. Supplementary and final provision

Modifications etc. (not altering text)

C1 Pt. 7 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))

Rights of the data subject U.K.

184 Prohibition of requirement to produce relevant records U.K.

(1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with—

(a) the recruitment of an employee by P1,

(b) the continued employment of a person by P1, or

(c) a contract for the provision of services to P1.

(2) It is an offence for a person (“P2”) to require another person to provide P2 with, or give P2 access to, a relevant record if—

(a) P2 is involved in the provision of goods, facilities or services to the public or a section of the public, and

(b) the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or to a third party.

(3) It is a defence for a person charged with an offence under subsection (1) or (2) to prove that imposing the requirement—

(a) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

(b) in the particular circumstances, was justified as being in the public interest.

(4) The imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as justified as being in the public interest on the ground that it would assist in the prevention or detection of crime, given [F1 —

(a) Part 5 of the Police Act 1997 (certificates of criminal records etc), and

(b) Part 1 of the Disclosure (Scotland) Act 2020 (disclosure of criminal history and other information).]

(5) In subsections (1) and (2), the references to a person who requires another person to provide or give access to a relevant record include a person who asks another person to do so—

(a) knowing that, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request, or

(b) being reckless as to whether, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request,

and the references to a “requirement” in subsections (3) and (4) are to be interpreted accordingly.

(6) In this section—

• “employment” means any employment, including—

  (a)

  work under a contract for services or as an office-holder,

  (b)

  work under an apprenticeship,

  (c)

  work experience as part of a training course or in the course of training for employment, and

  (d)

  voluntary work,

  and “employee” is to be interpreted accordingly;

• “relevant record” has the meaning given in Schedule 18 and references to a relevant record include—

  (a)

  a part of such a record, and

  (b)

  a copy of, or of part of, such a record.

Textual Amendments

F1 S. 184(4)(a)(b) substituted for words (1.4.2025) by The Disclosure (Scotland) Act 2020 (Consequential Provisions and Modifications) Order 2025 (S.I. 2025/423), art. 2(1), Sch. 2 para. 3(2)

Commencement Information

I1 S. 184 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

185 Avoidance of certain contractual terms relating to health records U.K.

(1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which—

(a) consists of the information contained in a health record, and

(b) has been or is to be obtained by a data subject in the exercise of a data subject access right.

(2) A term or condition of a contract is also void in so far as it purports to require an individual to produce such a record to another person.

(3) The references in subsections (1) and (2) to a record include a part of a record and a copy of all or part of a record.

(4) In this section, “data subject access right” means a right under—

(a) Article 15 of the [F2 UK GDPR] (right of access by the data subject);

(b) Article 20 of the [F3 UK GDPR] (right to data portability);

(c) section 45 of this Act (law enforcement processing: right of access by the data subject);

(d) section 94 of this Act (intelligence services processing: right of access by the data subject).

Textual Amendments

F2 Words in s. 185(4)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 79 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F3 Words in s. 185(4)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 79 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I2 S. 185 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

186 [F4 Protection of data subject’s rights] U.K.

(1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and rights provided for in the provisions listed in subsection (2) F5 ....

(2) The provisions providing obligations and rights are—

(a) Chapter III of the [F6 UK GDPR] (rights of the data subject),

(b) Chapter 3 of Part 3 of this Act (law enforcement processing: rights of the data subject), and

(c) Chapter 3 of Part 4 of this Act (intelligence services processing: rights of the data subject).

[F7 (2A) Subsection (1) does not apply—

(a) to an enactment contained in, or made under, a provision listed in subsection (2),

(b) to an enactment contained in, or made under, a provision listed in subsection (3),

(c) to the extent that an enactment makes express provision to the contrary referring to this section or to a provision listed in subsection (2), or

(d) to the extent that subsection (1) is disapplied by section 186A(3).]

(3) The [F8 provisions referred to in subsection (2A)(b)] are—

(a) in Chapter 2 of Part 2 of this Act, sections 15 and 16 and Schedules 2, 3 and 4,

(b) in Chapter 3 of Part 2 of this Act, sections F9 ... 24, 25 and 26,

F10 (c) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(d) in Part 4 of this Act, Chapter 6 .

Textual Amendments

F4 S. 186 heading substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(a), 142(1); S.I. 2025/904, reg. 2(k)

F5 Words in s. 186(1) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(b), 142(1); S.I. 2025/904, reg. 2(k)

F6 Words in s. 186(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 80(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F7 S. 186(2A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(c), 142(1); S.I. 2025/904, reg. 2(k)

F8 Words in s. 186(3) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(d)(i), 142(1); S.I. 2025/904, reg. 2(k)

F9 Word in s. 186(3)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 80(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F10 S. 186(3)(c) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(d)(ii), 142(1); S.I. 2025/904, reg. 2(k)

Commencement Information

I3 S. 186 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[F11 186A Protection of data subject’s rights: further provision U.K.

(1) This section is about the relationship between—

(a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and

(b) a provision of the UK GDPR or this Act listed in section 186(2).

(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).

(3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).

(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.

(5) In this section, “pre-commencement enactment” means an enactment so far as passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).]

Textual Amendments

F11 S. 186A inserted (1.1.2024) by Data (Use and Access) Act 2025 (c. 18), ss. 106(5)(7), 142(1); S.I. 2025/904, reg. 2(k)