{
  "url": "https://openlegislation.uk/data-protection-act-2018/section-93",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/section-93.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "section/93",
  "kind": "section",
  "number": "93",
  "heading": "Right to information",
  "text": "(1) The controller must give a data subject the following information—\n(a) the identity and the contact details of the controller;\n(b) the legal basis on which, and the purposes for which, the controller processes personal data;\n(c) the categories of personal data relating to the data subject that are being processed;\n(d) the recipients or the categories of recipients of the personal data (if applicable);\n(e) the right to lodge a complaint with the Commission under section 165 and the contact details of the Commission;\n(f) how to exercise rights under this Chapter;\n(g) any other information needed to secure that the personal data is processed fairly and transparently.\n(2) The controller may comply with subsection (1) by making information generally available, where the controller considers it appropriate to do so.\n(3) The controller is not required under subsection (1) to give a data subject information that the data subject already has.\n(4) Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in subsection (1) has effect, in relation to the personal data so collected, with the following exceptions—\n(a) the requirement does not apply in relation to processing that is authorised by an enactment;\n(b) the requirement does not apply in relation to the data subject if giving the information to the data subject would be impossible or involve disproportionate effort.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Word in s. 93(1)(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Words in s. 93(1)(e) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 14; S.I. 2026/82, reg. 3(b) (with reg. 7)"
    },
    {
      "type": "I",
      "label": "I1",
      "text": "S. 93 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(a)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/section/93",
    "retrieved_at": "2026-10-29T09:04:55.804064+00:00",
    "licence": "OGL-UK-3.0",
    "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
    "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
  }
}