Notice obligations under the DPA 1998 [Archived]

The following Information Law practice note provides comprehensive and up to date legal information covering:

  • Notice obligations under the DPA 1998 [Archived]

Notice obligations under the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.

Changes as a result of the General Data Protection Regulation

The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the DPA 1998 and Directive 95/46/EC (the Data Protection Directive) from that date.

For further information, see Practice Note: Introduction to the EU GDPR and UK GDPR.

For a comprehensive introduction to the GDPR, collating key practical guidance, see: Data protection toolkit.

The basic obligation under Schedule 1, Part II of the DPA 1998 is that data controllers must notify data subjects of data processing about them.

There are limits to this obligation set out in Schedule 1 Part 2 of DPA 1998. Where data is not obtained directly from a data subject (ie indirectly via a third party), the data controller does not have to provide notice of processing to the data subject where:

'the provision of that information would involve a disproportionate effort, or the recording of the information to be contained in the data by, or the disclosure of the data by, the data

Popular documents