Section 169(2)

Under subsection (1)— a controller involved in processing of personal data is liable for any damage caused by the processing, and a processor involved in processing of personal data is liable for damage caused by the processing only if the processor— has not complied with an obligation under the data protection legislation specifically directed at processors, or has acted outside, or contrary to, the controller's lawful instructions.

← 1 · All articles · 3 →

Source: legislation.gov.uk · retrieved 2026-09-04