Remedy
Start free

Section 6: Meaning of "controller"

Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk

Part 2: General processing — CHAPTER 2: The UK GDPR

The definition of "controller" in Article 4(1)(7) of the UK GDPR has effect subject to—

subsection (2),
section 209, and
section 210.

For the purposes of the UK GDPR, where personal data is processed only—

for purposes for which it is required by an enactment to be processed, and
by means by which it is required by an enactment to be processed,

the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

About this text

This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.

Reuse reviewed 21 August 2026 under Open Government Licence v3.0.