{
  "url": "https://openlegislation.uk/data-protection-act-2018/section-102",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/section-102.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "section/102",
  "kind": "section",
  "number": "102",
  "heading": "General obligations of the controller",
  "text": "Each controller must implement appropriate measures—\n(a) to ensure, and\n(b) to be able to demonstrate, in particular to the Commission,\nthat the processing of personal data complies with the requirements of this Part.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Word in s. 102(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "I",
      "label": "I1",
      "text": "S. 102 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(b)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/section/102",
    "retrieved_at": "2026-10-28T17:00:05.588950+00:00",
    "licence": "OGL-UK-3.0",
    "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
    "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
  }
}