Data Protection Act 2018

Chapter 5




137. (1) The Commission may, for the purposes of an inquiry referred to in section 110 (1) or 123 (1), cause such investigation as it thinks fit to be carried out.

(2) The Commission may, for the purposes of subsection (1), direct one or more authorised officers—

(a) to carry out the investigation, and

(b) to submit to the Commission an investigation report following the completion of the investigation.

(3) The Commission may define the scope and terms of the investigation to be carried out, whether as respects the matters or the period to which it is to extend or otherwise, and may, in particular, limit the investigation to matters connected with particular circumstances.

(4) Where more than one authorised officer has been directed to carry out an investigation, the investigation report shall be prepared jointly by the authorised officers so directed and this section and sections 138 to 140 shall, with all necessary modifications, be construed accordingly.

(5) As soon as is practicable after being appointed to carry out an investigation, the authorised officer shall—

(a) give the controller or processor concerned notice in writing—

(i) where the examination concerned is being carried out in respect of a complaint within the meaning of Chapter 2 or 3, setting out the particulars of the complaint concerned, or

(ii) where the examination is being carried out of the Commission’s own volition, setting out the matters to which the investigation relates,


(b) afford to the controller or processor an opportunity to respond to the notice under paragraph (a) within 7 days from the date on which the notice was given (or such further period not exceeding 28 days as the authorised officer allows).