Data Protection Act 2018, section 149

Enforcement notices

PART 6 Enforcement

(1) Where the [F614 Commission F614] is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) [F615 , (5) or (5A) F615] , the [F614 Commission F614] may give the person a written notice (an “enforcement notice”) which requires the person—

(a)to take steps specified in the notice, or

(b)to refrain from taking steps specified in the notice,

or both (and see also sections 150 and 151).

(2)The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following—

(a)a provision of Chapter II of the [F616UK GDPRF616] or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);

(b)a provision of [F617or made underF617] Articles 12 to [F61822DF618] of the [F619UK GDPRF619] or Part 3 or 4 of this Act conferring rights on a data subject;

(c)a provision of Articles 25 to 39 of the [F620UK GDPRF620] or section 64 or 65 of this Act (obligations of controllers and processors);

(d)a requirement to communicate a personal data breach to the [F621CommissionF621] or a data subject under section 67, 68 or 108 of this Act;

(e)the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles [F62244A to 49AF622] of the [F623UK GDPRF623] or in sections 73 to 78 or 109 of this Act.

(3)The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the [F624UK GDPRF624] (monitoring of approved codes of conduct).

(4)The third type of failure is where a person who is a certification provider—

(a)does not meet the requirements for accreditation,

(b)has failed, or is failing, to comply with an obligation under Article 42 or 43 of the [F625UK GDPRF625] (certification of controllers and processors), or

(c)has failed, or is failing, to comply with any other provision of the [F626UK GDPRF626] (whether in the person's capacity as a certification provider or otherwise).

(5)The fourth type of failure is where a controller has failed, or is failing, to comply with regulations under section 137.

[F627 (5A)The fifth type of failure is where a controller has failed, or is failing, to comply with section 164A or with regulations under section 164B.F627]

(6)An enforcement notice given in reliance on subsection (2), (3) [F628, (5) or (5A)F628] may only impose requirements which the [F629CommissionF629] considers appropriate for the purpose of remedying the failure.

(7)An enforcement notice given in reliance on subsection (4) may only impose requirements which the [F629CommissionF629] considers appropriate having regard to the failure (whether or not for the purpose of remedying the failure).

(8)The Secretary of State may by regulations confer power on the [F629CommissionF629] to give an enforcement notice in respect of other failures to comply with the data protection legislation.

(9)Regulations under this section—

(a)may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,

(b)may make provision about the giving of an information notice, an assessment notice[F630 , an interview noticeF630] or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 [F631, 148A, 148BF631] and 155 to 157 and Schedules 15 and 16, and

(c)are subject to the affirmative resolution procedure.

Definitions used in section 149 8

enforcement notice

“enforcement notice” has the meaning given in section 149;

Defined in s.181 · see it in the full Act
international organisation

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

Defined in s.205(1) · see it in the full Act
certification provider

“certification provider” has the meaning given in section 17;

Defined in s.181 · see it in the full Act
information notice

“information notice” has the meaning given in section 142;

Defined in s.181 · see it in the full Act
assessment notice

“assessment notice” has the meaning given in section 146;

Defined in s.181 · see it in the full Act
interview notice

“interview notice” has the meaning given in section 148A;

Defined in s.181 · see it in the full Act
penalty notice

“penalty notice” has the meaning given in section 155;

Defined in s.181 · see it in the full Act
the affirmative resolution procedure

(7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

Defined in s.182(7) · see it in the full Act

Cases considering section 149 6

Doorstep Dispensaree Limited v The Information Commissioner

[2024] EWCA Civ 1515 · 9 December 2024Defines

Defines the first type of failure relevant to the Commissioner’s power to issue a penalty notice. (see paras [16]-[17], [39]) Includes failures to comply with principles of processing in Chapter II of the GDPR. (see para [17]) Includes failures concerning provisions conferring rights on data subjects. (see para [17]) Includes failures concerning obligations of controllers and processors. (see para [17]) Cited only. Cited only. Cited only.

The Information Commissioner v Experian Limited

[2024] UKUT 105 (AAC) · 22 April 2024Limits

The Tribunal explains that an enforcement notice may require specified steps or restraint where the Commissioner is satisfied that a person has failed or is failing to comply with the statutory data-protection requirements. (see paras [67]-[70]) The Tribunal identifies non-compliance with Part II or GDPR Articles 12 to 22 as a relevant statutory failure supporting an enforcement notice. (see paras [67]-[70]) An enforcement notice may impose only requirements considered appropriate for remedying the relevant failure. (see paras [67]-[70])

Doorstep Dispensaree Ltd v The Information Commissioner

[2023] UKUT 132 (AAC) · 1 June 2023Limits

The Tribunal treated section 149(1) as identifying failures capable of founding an enforcement notice and as part of the statutory context for determining the Commissioner’s satisfaction and the appeal issues. (see paras [64], [179]) The provision was applied to identify failures capable of grounding a monetary penalty notice. The judgment confirmed that Article 24(1) was not included among the listed penalisable failures. (see paras [25], [46], [48]-[50], [193])

What each judgment says about section 149 is in the case-law panel in the full Act.

Amendments and notes

20 notes from legislation.gov.uk

Amendments

  1. F614Word in s. 149(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  2. F615Words in s. 149(1) substituted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 16(2); S.I. 2026/82, reg. 3(b) (with reg. 7)
  3. F616Words in s. 149(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F617Words in s. 149(2)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 15(a); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  5. F618Word in s. 149(2)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 15(b); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  6. F619Words in s. 149(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F620Words in s. 149(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F621Word in s. 149(2)(d) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  9. F622Words in s. 149(2)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 21 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  10. F623Words in s. 149(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  11. F624Words in s. 149(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  12. F625Words in s. 149(4)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  13. F626Words in s. 149(4)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  14. F627S. 149(5A) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 16(3); S.I. 2026/82, reg. 3(b) (with reg. 7)
  15. F628Words in s. 149(6) substituted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 16(4); S.I. 2026/82, reg. 3(b) (with reg. 7)
  16. F629Word in s. 149(6)-(8) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  17. F630Words in s. 149(9)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(3)(a), 142(1); S.I. 2026/82, reg. 2(s)
  18. F631Words in s. 149(9)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(3)(b), 142(1); S.I. 2026/82, reg. 2(s)

Commencement

  1. I153S. 149 in force at Royal Assent for specified purposes, see s. 212(2)(f) text for certain specified purposes only, see the commentary.
  2. I154S. 149 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(f)