OpenLegislation

Section 146 Assessment noticesI1

(1)

The F1Commission may by written notice (an “assessment notice”) require a controller or processor to permit the Commission to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.

(2)

An assessment notice may require the controller or processor to do any of the following—

(a)

permit F2a member of the Commission or a member of its staff to enter specified premises;

(b)

direct a member of the Commission or a member of its staff to documents on the premises that are of a specified description;

(c)

assist a member of the Commission or a member of its staff to view information of a specified description that is capable of being viewed using equipment on the premises;

(d)

comply with a request from F3a member of the Commission or a member of its staff for a copy (in such form as may be requested) of—

(i)

the documents to which F4that person is directed under paragraph (b);

(ii)

the information which F5that person is assisted to view under paragraph (c);

(e)

direct F6a member of the Commission or a member of its staff to equipment or other material on the premises which is of a specified description;

(f)

permit F7a member of the Commission or a member of its staff to inspect or examine the documents, information, equipment or material to which F8that person is directed under paragraph (b) or which that person is assisted to view under paragraph (c);

(g)

provide F9a member of the Commission or a member of its staff with an explanation of such documents, information, equipment or material;

(h)

permit a member of the Commission or a member of its staff to observe the processing of personal data that takes place on the premises;

(i)

make available for interview by a member of the Commission or a member of its staff a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed;

(j)

F10make arrangements for an approved person to prepare a report on a specified matter;

(k)

provide to the F11Commission a report prepared in pursuance of such arrangements.

(3)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3A)

F13An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to—

(a)

the preparation of the report;

(b)

the contents of the report;

(c)

the form in which the report is to be provided;

(d)

the date by which the report is to be completed.

(4)

An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).

(5)

An assessment notice must provide information about—

(a)

the consequences of failure to comply with it, and

(b)

the rights under sections 162 and 164 (appeals etc).

(6)

An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice.

(7)

If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal.

(8)

If an assessment notice—

(a)

states that, in the F14Commission's opinion, it is necessary for the controller or processor to comply with a requirement in the notice urgently,

(b)

gives the Commission's reasons for reaching that opinion, and

(c)

does not meet the conditions in subsection (9)(a) to (d),

subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.

(9)

If an assessment notice—

(a)

states that, in the Commission's opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 149(2) or that an offence under this Act has been or is being committed,

(b)

indicates the nature of the suspected failure or offence,

(c)

does not specify domestic premises,

(d)

states that, in the Commission's opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and

(e)

gives the Commission's reasons for reaching that opinion,

subsections (6) and (7) do not apply.

(10)

The Commission may cancel an assessment notice by written notice to the controller or processor to whom it was given.

(11)

Where the Commission gives an assessment notice to a processor, the Commission must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.

(11A)

F15Where the Commission gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person’s remuneration and expenses under the arrangements.

(12)

In this section—

  • F16“approved person”, in relation to a report, means a person approved to prepare the report in accordance with section 146A;

  • “domestic premises” means premises, or a part of premises, used as a dwelling;

  • “specified” means specified in an assessment notice.

Annotations

Textual amendments

F1

Word in s. 146(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

F2

Words in s. 146(2)(a)-(c) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(i); S.I. 2026/1015, reg. 2(c)

F3

Words in s. 146(2)(d) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(ii)(aa); S.I. 2026/1015, reg. 2(c)

F4

Words in s. 146(2)(d)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(ii)(bb); S.I. 2026/1015, reg. 2(c)

F5

Words in s. 146(2)(d)(ii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(ii)(cc); S.I. 2026/1015, reg. 2(c)

F6

Words in s. 146(2)(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(iii); S.I. 2026/1015, reg. 2(c)

F7

Words in s. 146(2)(f) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(iv)(aa); S.I. 2026/1015, reg. 2(c)

F8

Words in s. 146(2)(f) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(iv)(bb); S.I. 2026/1015, reg. 2(c)

F9

Words in s. 146(2)(g)-(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(a)(v); S.I. 2026/1015, reg. 2(c)

F10

S. 146(2)(j)(k) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(a), 142(1); S.I. 2026/82, reg. 2(q)

F11

Word in s. 146(2)(k) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

F12

S. 146(3) omitted (30.9.2026) by virtue of The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(8)(b); S.I. 2026/1015, reg. 2(c)

F13

S. 146(3A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(b), 142(1); S.I. 2026/82, reg. 2(q)

F14

Word in s. 146(8)-(11A) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

F15

S. 146(11A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(c), 142(1); S.I. 2026/82, reg. 2(q)

F16

Words in s. 146(12) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(d), 142(1); S.I. 2026/82, reg. 2(q)

Commencement

I1

S. 146 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)