Data Protection Act 2018, section 167

Compliance orders

PART 6 Enforcement

(1)This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.

(2)A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—

(a)to take steps specified in the order, or

(b)to refrain from taking steps specified in the order.

(3)The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.

(4)In subsection (1)—

(a)the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the [F715UK GDPRF715] (right to an effective remedy against a controller or processor);

(b)the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.

(5)In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.

Cases considering section 167 21

Ben Peter Delo, R (on the application of) v The Information Commissioner

[2023] EWCA Civ 1141 · 10 October 2023Defines

Confirms: a direct court claim may secure compliance by the controller after an infringement is established and may be a relevant alternative enforcement route. (see paras [24]-[25]; [47]-[49]; [72]; [94]) Confirms: section 167 has wider scope because the defined expression data protection legislation includes relevant provisions of the Data Protection Act 2018 as well as the UK GDPR. (see para [25])

Veronica Strain, R (on the application of) v The Chief Constable of Greater Manchester Police

[2023] EWCA Civ 240 · 7 March 2023

The court held that the section 167 compliance-order remedy was an adequate alternative to judicial review for the dispute concerning deletion of personal data. (see paras [19]; [21]; [25])

Mark Dowding v The Character Group Plc

[2025] EWHC 1755 (KB) · 11 July 2025

Applies the discretionary power to order compliance with data subject access rights. The court held that the relevant factors, including prior disclosure, lack of legitimate value and procedural abuse, pointed against relief. (see Appendix Day 4 [43]-[55])

1 more judgment, and what each says about section 167, are in the case-law panel in the full Act.

Amendments and notes

2 notes from legislation.gov.uk

Amendments

  1. F715Words in s. 167(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 68 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I174S. 167 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)