Data Protection Act 1998

5 Application of Act. U.K.

(1) Except as otherwise provided by or under section 54, this Act applies to a data controller in respect of any data only if—

(a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment, or

(b) the data controller is established neither in the United Kingdom nor in any other EEA State but uses equipment in the United Kingdom for processing the data otherwise than for the purposes of transit through the United Kingdom.

[F1 (1A) Subsection (1) is subject to regulation 50 of the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014. ]

(2) A data controller falling within subsection (1)(b) must nominate for the purposes of this Act a representative established in the United Kingdom.

(3) For the purposes of subsections (1) and (2), each of the following is to be treated as established in the United Kingdom—

(a) an individual who is ordinarily resident in the United Kingdom,

(b) a body incorporated under the law of, or of any part of, the United Kingdom,

(c) a partnership or other unincorporated association formed under the law of any part of the United Kingdom, and

(d) any person who does not fall within paragraph (a), (b) or (c) but maintains in the United Kingdom—

(i) an office, branch or agency through which he carries on any activity, or

(ii) a regular practice;

and the reference to establishment in any other EEA State has a corresponding meaning.

Textual Amendments

F1 S. 5(1A) inserted (3.12.2014) by The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), regs. 1(b), 52(a)

Modifications etc. (not altering text)

C1 S. 5 modified by S.I. 1993/1813, art. 4(2) (as substituted (coming into force in accordance with art. 1(2) of the amending S.I.) by S.I. 2001/1544, art. 3(5)(6))