Criminal Offences under the Data Protection Act 2018
The Data Protection Act 2018 (DPA 2018), which operates alongside the UK General Data Protection Regulation (UK GDPR), establishes the framework for the lawful handling of personal data in the United Kingdom. Beyond the civil regulatory regime — which includes fines imposed by the Information Commissioner's Office (ICO) — the Act creates a number of specific criminal offences that can result in prosecution, an unlimited fine, and a permanent criminal record.
Prosecutions under the DPA 2018 are typically brought by the ICO. They most commonly target individuals, including employees and former employees, who access or share personal data outside the scope of their authorised role.
Section 170 — Unlawful Obtaining and Disclosure
Section 170 is the most frequently prosecuted provision of the Act. It makes it a criminal offence to knowingly or recklessly obtain, disclose, or procure the disclosure of personal data without the consent of the data controller. This offence is commonly committed by employees who access records beyond the scope of their role, or by former employees who retain data after leaving an organisation.
The prosecution must prove that the defendant knew, or was reckless as to whether, the obtaining or disclosure was without the data controller's consent. A genuine and reasonable belief in authorisation may provide a basis for defence.
The Retention Offence
The DPA 2018 provides that retaining personal data without consent is itself an offence, even where that data was originally obtained through lawful means. A person who receives data for a specific purpose — for example, in the course of a project — and who continues to hold it after that purpose has ended, or after consent has been withdrawn by the data controller, may face criminal liability.
Section 171 — Re-identification of Personal Data
Section 171 targets the de-anonymisation or re-identification of personal data that has been anonymised or redacted. This offence commonly arises in data scraping scenarios, or where software is used to reconstruct or bypass redaction applied to legal, medical, or other disclosed documents. It is not a defence that the data was already in the public domain in anonymised form.
Other Regulatory Offences
The DPA 2018 also creates offences related to interference with the ICO's enforcement functions:
- Section 119: Obstructing the Commissioner in the exercise of powers to inspect data in connection with international obligations.
- Section 148: Destroying or falsifying information or documents that have been requested by the ICO.
- Section 173: Altering personal data with the intention of preventing its disclosure to the data subject following a Subject Access Request.
- Section 184: Requiring a person to produce certain records as a condition of employment or the provision of a service, where there is no lawful basis for doing so.
Consequences of Conviction
The criminal offences under the DPA 2018 do not carry custodial sentences as the primary penalty. However, a conviction results in an unlimited fine and a permanent criminal record. For professionals in regulated sectors — including financial services, healthcare, and legal services — a conviction may trigger disciplinary proceedings by the relevant professional body and can affect a person's ability to satisfy fitness and propriety requirements.
What to Do if You Are Under Investigation
If you have been contacted by the ICO, received an information notice, or are under investigation for a data protection offence, seek specialist legal advice immediately. Do not respond to an information notice or attend any interview without a solicitor present. The ICO has significant investigative powers, and early legal advice can be decisive in determining how the investigation develops.