{
  "url": "https://openlegislation.uk/data-protection-act-2018/schedule-16/paragraph-5",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/schedule-16/paragraph-5.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "schedule/16/paragraph/5",
  "kind": "paragraph",
  "number": "5",
  "heading": null,
  "text": "(1) A penalty notice must contain the following information—\n(a) the name and address of the person to whom it is addressed;\n(b) details of the notice of intent given to the person;\n(c) whether the Commission received oral or written representations in accordance with the notice of intent;\n(d) the reasons why the Commission proposes to impose the penalty (see sub-paragraph (2));\n(e) the reasons for the amount of the penalty, including any aggravating or mitigating factors that the Commission has taken into account;\n(f) details of how the penalty is to be paid;\n(g) details of the rights of appeal under section 162;\n(h) details of the Commission's enforcement powers under this Schedule.\n(2) The information required under sub-paragraph (1)(d) includes—\n(a) a description of the circumstances of the failure, and\n(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Word in Sch. 16 para. 5(1)(c)-(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Word in Sch. 16 para. 5(1)(h) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "C",
      "label": "C1",
      "text": "Sch. 16 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))"
    },
    {
      "type": "I",
      "label": "I1",
      "text": "Sch. 16 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/5",
    "retrieved_at": "2026-10-29T09:04:55.804064+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}