Subsection (3) applies where—
a request has been made in exercise of a data subject access right, and
the person making the request would have been entitled to receive information in response to that request.
In this section, "data subject access right" means a right under—
Article 15 of the UK GDPR (right of access by the data subject);
Article 20 of the UK GDPR (right to data portability);
section 45 of this Act (law enforcement processing: right of access by the data subject);
section 94 of this Act (intelligence services processing: right of access by the data subject).
It is an offence for a person listed in subsection (4) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive.
Those persons are—
the controller, and
a person who is employed by the controller, an officer of the controller or subject to the direction of the controller.
It is a defence for a person charged with an offence under subsection (3) to prove that—
the alteration, defacing, blocking, erasure, destruction or concealment of the information would have occurred in the absence of a request made in exercise of a data subject access right, or
the person acted in the reasonable belief that the person making the request was not entitled to receive the information in response to the request.