Remedy
Start free

Section 81: Reporting of infringements

Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk

Part 3: Law enforcement processing — CHAPTER 6: Supplementary

Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part.

The mechanisms implemented under subsection (1) must provide that an infringement may be reported to any of the following persons—

the controller;
the Commissioner.

The mechanisms implemented under subsection (1) must include—

raising awareness of the protections provided by Part 4A of the Employment Rights Act 1996 and Part 5A of the Employment Rights (Northern Ireland) Order 1996 (S.I. 1996/1919 (N.I. 16)), and
such other protections for a person who reports an infringement of this Part as the controller considers appropriate.

A person who reports an infringement of this Part does not breach—

an obligation of confidence owed by the person, or
any other restriction on the disclosure of information (however imposed).

Subsection (4) does not apply if or to the extent that the report includes a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (5) has effect as if it included a reference to that Part.

About this text

This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.

Reuse reviewed 21 August 2026 under Open Government Licence v3.0.