Data Protection Act

19. Application for registration

Edition: 2022-12-31 · In force

(1)A data controller or data processor required to register under section 18 shall apply to the Data Commissioner.

(2)An application under subsection (1) shall provide the following particulars—

(a)a description of the personal data to be processed by the data controller or data processor;

(b)a description of the purpose for which the personal data is to be processed;

(c)the category of data subjects, to which the personal data relates;

(d)contact details of the data controller or data processor;

(e)a general description of the risks, safeguards, security measures and mechanisms to ensure the protection of personal data;

(f)any measures to indemnify the data subject from unlawful use of data by the data processor or data controller; and

(g)any other details as may be prescribed by the Data Commissioner.

(3)A data controller or data processor who knowingly supplies any false or misleading detail under subsection (1) commits an offence.

(4)The Data Commissioner shall issue a certificate of registration where a data controller or data processor meets the requirements for registration.

(5)A data controller or data processor shall notify the Data Commissioner of a change in any particular outlined under subsection (2).

(6)On receipt of a notification under subsection (5), the Data Commissioner shall amend the respective entry in the Register.

(7)A data controller or data processor who fails to comply with the provisions of this section commits an offence.