Section 83 Meaning of “controller” and “processor”I1

F1(A1)

For the purposes of this Part—

(a)

an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and

(b)

a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.

(1)

F2This subsection is satisfied by a person who—

(a)

determines the purposes and means of the processing of personal data, or

(b)

is the controller by virtue of subsection (2).

(2)

Where personal data is processed only—

(a)

for purposes for which it is required by an enactment to be processed, and

(b)

by means by which it is required by an enactment to be processed,

the F3person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3)

In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

Annotations

Textual amendments

F1: S. 83(A1) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(4)(a), 142(1); S.I. 2025/996, reg. 2(2)(b)
F2: Words in s. 83(1) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(4)(b), 142(1); S.I. 2025/996, reg. 2(2)(b)
F3: Words in s. 83(2) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(4)(c), 142(1); S.I. 2025/996, reg. 2(2)(b)

Commencement

I1: S. 83 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)