Data Protection Act 2018

160 Guidance about regulatory action

(1) The Commissioner must produce and publish guidance about how the Commissioner proposes to exercise the Commissioner’s functions in connection with—

(a) information notices,

(b) assessment notices,

(c) enforcement notices, and

(d) penalty notices.

(2) The Commissioner may produce and publish guidance about how the Commissioner proposes to exercise the Commissioner’s other functions under this Part.

(3) In relation to information notices, the guidance must include—

(a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an information notice.

(4) In relation to assessment notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an assessment notice to a person;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases);

(c) provision specifying descriptions of documents or information that—

(i) are not to be examined or inspected in accordance with an assessment notice, or

(ii) are to be so examined or inspected only by a person of a description specified in the guidance;

(d) provision about the nature of inspections and examinations carried out in accordance with an assessment notice;

(e) provision about the nature of interviews carried out in accordance with an assessment notice;

(f) provision about the preparation, issuing and publication by the Commissioner of assessment reports in respect of controllers and processors that have been given assessment notices;

(g) provision about how the Commissioner will determine how to proceed if a person does not comply with an assessment notice.

(5) The guidance produced in accordance with subsection (4)(c) must include provisions that relate to—

(a) documents and information concerning an individual’s physical or mental health;

(b) documents and information concerning the provision of social care for an individual.

(6) In relation to enforcement notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an enforcement notice to a person in reliance on section 150(8) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an enforcement notice.

(7) In relation to penalty notices, the guidance must include—

(a) provision about the circumstances in which the Commissioner would consider it appropriate to issue a penalty notice;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to allow a person to make oral representations about the Commissioner’s intention to give the person a penalty notice;

(c) provision explaining how the Commissioner will determine the amount of penalties;

(d) provision about how the Commissioner will determine how to proceed if a person does not comply with a penalty notice.

(8) The Commissioner—

(a) may alter or replace guidance produced under this section, and

(b) must publish any altered or replacement guidance.

(9) Before producing guidance under this section (including any altered or replacement guidance), the Commissioner must consult—

(a) the Secretary of State, and

(b) such other persons as the Commissioner considers appropriate.

(10) Section 161 applies in relation to the first guidance under subsection (1).

(11) The Commissioner must arrange for other guidance under this section (including any altered or replacement guidance) to be laid before Parliament.

(12) In this section, “social care” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).