{
  "url": "https://openlegislation.uk/data-protection-act-2018/section-105",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/section-105.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "section/105",
  "kind": "section",
  "number": "105",
  "heading": "Processors",
  "text": "(1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.\n(2) The controller may use only a processor who undertakes—\n(a) to implement appropriate measures that are sufficient to secure that the processing complies with this Part;\n(b) to provide to the controller such information as is necessary for demonstrating that the processing complies with this Part.\n(3) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "I",
      "label": "I1",
      "text": "S. 105 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(e)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/section/105",
    "retrieved_at": "2026-10-28T17:00:05.588950+00:00",
    "licence": "OGL-UK-3.0",
    "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
    "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
  }
}