Data Protection Act 2018, section 166

Orders to progress complaints to the Commission

PART 6 Enforcement

(1)F713This section applies where, after a data subject makes a complaint under section 165 ..., the [F714CommissionF714] —

(a)fails to take appropriate steps to respond to the complaint,

(b)fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the [F714CommissionF714] received the complaint, or

(c)if the [F714Commission'sF714] consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)The Tribunal may, on an application by the data subject, make an order requiring the [F714CommissionF714] —

(a)to take appropriate steps to respond to the complaint, or

(b)to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)An order under subsection (2)(a) may require the [F714CommissionF714] —

(a)to take steps specified in the order;

(b)to conclude an investigation, or take a specified step, within a period specified in the order.

(4)Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

Definitions used in section 166 2

tribunal

“tribunal” means any tribunal in which legal proceedings may be brought;

Defined in s.205(1) · see it in the full Act
the Tribunal

“the Tribunal”, in relation to an application or appeal under this Act, means—

(a)

the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, or

(b)

the First-tier Tribunal, in any other case.

Defined in s.205(1) · see it in the full Act

Cases considering section 166 6

Ben Peter Delo, R (on the application of) v The Information Commissioner

[2023] EWCA Civ 1141 · 10 October 2023Interprets

Interprets: the court accepted the procedural focus of section 166 but left open the belated argument that it might apply after an outcome had been given; the provision was not treated as a merits route. (see paras [23]; [43]-[49])

Dr Michael Guy Smith v Information Commissioner

[2025] UKUT 74 (AAC) · 28 February 2025Limits

Interprets section 166(1) as identifying procedural failures concerning response, progress information and outcome information. The remedy is not directed to the merits of the complaint (see paras [40]-[43], [60]-[61]). Applies section 166(2) as empowering the Tribunal to order appropriate procedural steps or the provision of progress or outcome information. An order may remain possible after an outcome where part of a complaint was overlooked (see paras [43], [59]-[61], [132]). Confirms that an order may specify steps or require an investigation or specified step to be completed within a stated period. The power remains procedural and cannot be used to secure a different merits outcome (see paras [40]-[45]). Confirms that section 165(5)’s meaning of appropriate steps applies to section 166 applications. The Tribunal therefore assesses procedural response and investigation obligations rather than the merits of the complaint (see paras [40]-[43]).

Ben Peter Delo, R (on the application of) v The Information Commissioner & Anor

[2022] EWHC 3046 (Admin) · 2 December 2022Limits

Limits the statutory Tribunal remedy to failure to take appropriate steps to respond while the complaint is within the procedural process. Limits the Tribunal remedy to failure to provide timely information about progress or outcome within three months of the complaint. Confirms that the procedural remedy also applies where the Commissioner fails to provide the required information during a subsequent three-month period. Limits Tribunal orders to requiring appropriate procedural steps to respond to a pending complaint; it does not authorise a merits-based reconsideration after an outcome has been given. Confirms the Tribunal’s power to require information about progress or outcome within a specified period, rather than to substitute its view on the merits. Confirms that a Tribunal order may specify procedural steps to be taken in response to a complaint, but cannot require disclosure or another merits outcome after the Commissioner has concluded the complaint. Limits the power to require conclusion of an investigation or a specified procedural step within a period; it does not extend to reviewing the merits of a completed outcome.

What each judgment says about section 166 is in the case-law panel in the full Act.

Amendments and notes

5 notes from legislation.gov.uk

Amendments

  1. F711Words in s. 166 heading inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 20(2); S.I. 2026/82, reg. 3(b) (with reg. 7)
  2. F712Word in s. 166 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3) (with reg. 1(5)); S.I. 2026/1015, reg. 2(c)
  3. F713Words in s. 166(1) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 20(3); S.I. 2026/82, reg. 3(b) (with reg. 7)
  4. F714Word in s. 166(1)-(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement

  1. I173S. 166 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)