Notice obligations under the DPA 1998 [Archived]
Notice obligations under the DPA 1998 [Archived]

The following Financial Services guidance note provides comprehensive and up to date legal information covering:

  • Notice obligations under the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.

Changes as a result of the General Data Protection Regulation

The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the DPA 1998 and Directive 95/46/EC (the Data Protection Directive) from that date.

For further information, see Practice Note: The General Data Protection Regulation (GDPR).

For a comprehensive introduction to the GDPR, collating key practical guidance, see: GDPR toolkit.

The basic obligation under Schedule 1, Part II of the DPA 1998 is that data controllers must notify data subjects of data processing about them.

There are limits to this obligation set out in Schedule 1 Part 2 of DPA 1998. Where data is not obtained directly from a data subject (ie indirectly via a third party), the data controller does not have to provide notice of processing to the data subject where:

'the provision of that information would involve a disproportionate effort, or the rec