Section 93 Right to informationI1

(1)

The controller must give a data subject the following information—

(a)

the identity and the contact details of the controller;

(b)

the legal basis on which, and the purposes for which, the controller processes personal data;

(c)

the categories of personal data relating to the data subject that are being processed;

(d)

the recipients or the categories of recipients of the personal data (if applicable);

(e)

the right to lodge a complaint with the F1Commission F2under section 165 and the contact details of the Commission;

(f)

how to exercise rights under this Chapter;

(g)

any other information needed to secure that the personal data is processed fairly and transparently.

(2)

The controller may comply with subsection (1) by making information generally available, where the controller considers it appropriate to do so.

(3)

The controller is not required under subsection (1) to give a data subject information that the data subject already has.

(4)

Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in subsection (1) has effect, in relation to the personal data so collected, with the following exceptions—

(a)

the requirement does not apply in relation to processing that is authorised by an enactment;

(b)

the requirement does not apply in relation to the data subject if giving the information to the data subject would be impossible or involve disproportionate effort.

Annotations

Textual amendments

F1: Word in s. 93(1)(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F2: Words in s. 93(1)(e) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 14; S.I. 2026/82, reg. 3(b) (with reg. 7)

Commencement

I1: S. 93 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(a)