Section 149(2)

The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following— a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing); a provision of or made under Articles 12 to 22D of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject; a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors); a requirement to communicate a personal data breach to the Commissioner or a data subject under section 67, 68 or 108 of this Act; the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44A to 49A of the UK GDPR or in sections 73 to 78 or 109 of this Act.

← 1 · All articles · 3 →

Source: legislation.gov.uk · retrieved 2026-09-04