Remedy
Start free

Section 149: Enforcement notices

Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk

Part 6: Enforcement

Where the Commissioner is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) or (5), the Commissioner may give the person a written notice (an "enforcement notice") which requires the person—

to take steps specified in the notice, or
to refrain from taking steps specified in the notice,

or both (and see also sections 150 and 151).

The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following—

a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);
a provision of or made under Articles 12 to 22D of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;
a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors);
a requirement to communicate a personal data breach to the Commissioner or a data subject under section 67, 68 or 108 of this Act;
the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44A to 49A of the UK GDPR or in sections 73 to 78 or 109 of this Act.

The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the UK GDPR (monitoring of approved codes of conduct).

The third type of failure is where a person who is a certification provider—

does not meet the requirements for accreditation,
has failed, or is failing, to comply with an obligation under Article 42 or 43 of the UK GDPR (certification of controllers and processors), or
has failed, or is failing, to comply with any other provision of the UK GDPR (whether in the person's capacity as a certification provider or otherwise).

The fourth type of failure is where a controller has failed, or is failing, to comply with regulations under section 137.

An enforcement notice given in reliance on subsection (2), (3) or (5) may only impose requirements which the Commissioner considers appropriate for the purpose of remedying the failure.

An enforcement notice given in reliance on subsection (4) may only impose requirements which the Commissioner considers appropriate having regard to the failure (whether or not for the purpose of remedying the failure).

The Secretary of State may by regulations confer power on the Commissioner to give an enforcement notice in respect of other failures to comply with the data protection legislation.

Regulations under this section—

may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,
may make provision about the giving of an information notice, an assessment notice , an interview notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 , 148A, 148B and 155 to 157 and Schedules 15 and 16, and
are subject to the affirmative resolution procedure.

About this text

This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.

Reuse reviewed 21 August 2026 under Open Government Licence v3.0.