{
  "url": "https://openlegislation.uk/data-protection-act-2018/section-91",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/section-91.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "section/91",
  "kind": "section",
  "number": "91",
  "heading": "The sixth data protection principle",
  "text": "(1) The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks that arise from processing personal data.\n(2) The risks referred to in subsection (1) include (but are not limited to) accidental or unauthorised access to, or destruction, loss, use, modification or disclosure of, personal data.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "I",
      "label": "I1",
      "text": "S. 91 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/section/91",
    "retrieved_at": "2026-10-28T17:00:05.588950+00:00",
    "licence": "OGL-UK-3.0",
    "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
    "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
  }
}