Remedy
Start free

Section 167: Compliance orders

Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk

Part 6: Enforcement

This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.

A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—

to take steps specified in the order, or
to refrain from taking steps specified in the order.

The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.

In subsection (1)—

the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the UK GDPR (right to an effective remedy against a controller or processor);
the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.

In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.

About this text

This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.

Reuse reviewed 21 August 2026 under Open Government Licence v3.0.