Data Protection Act 2018, offence of re-identifying de-identified personal data

Section 171(1) of the Data Protection Act 2018 makes it an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data. Under section 171(2) personal data is de-identified if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject.

Under section 171(2) a person re-identifies information if the person takes steps which result in the information no longer being de-identified. Section 171(5) separately makes it an offence knowingly or recklessly to process personal data that is information that has been re-identified, without the consent of the controller responsible for de-identifying the personal data, in circumstances in which the re-identification was an offence under section 171(1).

Section 171(3) makes it a defence to the re-identification offence to prove that the re-identification was necessary for the purposes of preventing, investigating or detecting crime, was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or in the particular circumstances was justified as being in the public interest.

The Data (Use and Access) Act 2025 inserted the word investigating into the crime-prevention defence in section 171(3)(a) from 5 February 2026.

Section 171(4) also makes it a defence to the re-identification offence to prove that the person acted in the reasonable belief that the person is the data subject or had or would have had the data subject's consent, that the person is the controller responsible for de-identifying the personal data or had or would have had that controller's consent, that the person acted for the special purposes with a view to publication of journalistic, academic, artistic or literary material in the reasonable belief that the re-identification was justified in the public interest, or that the effectiveness testing conditions were met.

The first effectiveness testing condition in section 172(2) is that the person acted with a view to testing the effectiveness of the de-identification of personal data, without intending to cause or threaten damage or distress to a person, and in the reasonable belief that re-identifying the information was justified in the public interest.

The second effectiveness testing condition in section 172(3) is that the person notified the Commission or the controller responsible for de-identifying the personal data about the re-identification without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

Section 171(6) makes it a defence to the processing offence to prove that the processing was necessary for the purposes of preventing, investigating or detecting crime, was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or in the particular circumstances was justified as being in the public interest.

Section 171(7) also makes it a defence to the processing offence to prove that the person acted in the reasonable belief that the processing was lawful, in the reasonable belief that the person had or would have had the consent of the controller responsible for de-identifying the personal data, or for the special purposes with a view to publication of journalistic, academic, artistic or literary material in the reasonable belief that the processing was justified in the public interest.

Consent given by a person who is a controller only because a processor is treated as a controller under Article 28(10) of the UK GDPR or section 59(8) or 105(3) of the Act does not count as the consent of a controller for section 171. Where there is more than one controller, references in section 171 to the consent of the controller are references to the consent of one or more of them.

A person who commits an offence under section 171 is liable on summary conviction in England and Wales to a fine, on summary conviction in Scotland or Northern Ireland to a fine not exceeding the statutory maximum, and on conviction on indictment to a fine. Section 171 has been in force since 25 May 2018.