13 criminal offences across 5 instruments: what each catches, the
mens reaMens reaThe mental element an offence requires, such as intention, knowledge or recklessness. Most DPA 2018 offences need knowledge or recklessness.Defined in: General criminal law, whether custody is available, the defences and who prosecutes. They run
separately from regulatory penalties, so a company can receive a penalty notice while an employee is prosecuted for
the same events.
Criminalises current or former staff of the regulator (the Information Commission since 2026-09-30, previously the Commissioner), and those acting on the regulator's behalf, who unlawfully disclose information obtained in the course of their duties. Replaces DPA 1998 s.59.
Mental element
Knowingly or recklessly
Penalty
Either way. On indictment, an unlimited fine; summarily, an unlimited fine in England and Wales and a fine up to the statutory maximum in Scotland and Northern Ireland (s.196(2)). No custodial sentence.
Defences
No statutory defence.
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
s.144
False statements in response to an information notice
Fine only
Making a statement in response to an information notice that the person knows to be false in a material respect, or recklessly making a statement that is false in a material respect.
Mental element
Knowingly or recklessly
Penalty
Either way. On indictment, an unlimited fine; summarily, an unlimited fine in England and Wales and a fine up to the statutory maximum in Scotland and Northern Ireland (s.196(2)). No custodial sentence.
Defences
No statutory defence.
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
s.148
Destroying or falsifying information and documents
Fine only
Where an information notice or assessment notice has been given, destroying, disposing of, concealing, blocking or falsifying information, a document, equipment or material, with the intention of preventing the regulator from viewing or being provided with it.
Mental element
Intention to prevent the regulator viewing or receiving the material
Penalty
Either way. On indictment, an unlimited fine; summarily, an unlimited fine in England and Wales and a fine up to the statutory maximum in Scotland and Northern Ireland (s.196(2)). No custodial sentence.
Defences
No statutory defence.
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
s.148C
False statements in response to an interview notice
Fine only
Making a statement in response to an interview notice that the person knows to be false in a material respect, or recklessly making a statement that is false in a material respect. Inserted by the DUAA 2025 s.100 and in force from 2026-02-05.
Mental element
Knowingly or recklessly
Penalty
Either way. On indictment, an unlimited fine; summarily, an unlimited fine in England and Wales and a fine up to the statutory maximum in Scotland and Northern Ireland (s.196(2)). No custodial sentence.
Defences
No statutory defence.
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
s.170
Unlawfully obtaining, disclosing, procuring or retaining personal data
Fine onlyRecordable
Obtaining or disclosing personal data without the controller's consent; procuring its disclosure to another person without consent; or retaining personal data after obtaining it without the consent of the person who was the controller at the time: the extension over the old DPA 1998 s.55 offence. Selling, or offering to sell, data knowingly or recklessly obtained or disclosed this way is also caught. Historically the most-charged data offence, commonly used against people who accessed healthcare or financial records out of curiosity or for gain.
Mental element
Knowingly or recklessly
Penalty
Either way. On indictment, an unlimited fine; summarily, an unlimited fine in England and Wales and a fine up to the statutory maximum in Scotland and Northern Ireland (s.196(2)). No custodial sentence.
Defences
Reasonable belief in the controller's consent; Acting under legal compulsion or a court order; For journalism, a reasonable belief that the conduct was justified in the public interest
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
s.171
Re-identification of de-identified personal data
Fine onlyRecordable
Re-identifying information that has been de-identified (for example by redaction) without the consent of the controller who de-identified it. Introduced on the recommendation of the National Data Guardian for Health and Care.
Mental element
Knowingly or recklessly
Penalty
Either way. On indictment, an unlimited fine; summarily, an unlimited fine in England and Wales and a fine up to the statutory maximum in Scotland and Northern Ireland (s.196(2)). No custodial sentence.
Defences
Re-identification necessary for preventing or detecting crime; Required or authorised by an enactment, a rule of law, or a court/tribunal order
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
s.173
Altering records to prevent disclosure
Fine onlyRecordable
A controller, or someone employed by, an officer of, or otherwise directed by the controller, who alters, defaces, blocks, erases, destroys or conceals information intending to prevent its disclosure to someone who had made a subject access request and would have been entitled to receive it. Builds on an equivalent FOIA 2000 offence.
Mental element
Intention to prevent disclosure of information the requester would have been entitled to
Penalty
Summary only. An unlimited fine in England and Wales; a fine up to level 5 on the standard scale in Scotland and Northern Ireland (s.196(1)). No custodial sentence.
Defences
The alteration or destruction would have happened regardless of the request
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
s.184
Enforced subject access
Fine only
Requiring another person to exercise their own subject access right and supply the resulting records as a condition of employment, of a contract, or of the provision of goods, facilities or services to the public: the "let us see your DSAR results before we'll hire, insure or serve you" scenario. Builds on DPA 1998 s.56; the "relevant records" concept is defined in Schedule 18.
Mental element
None required; the defences carry the weight
Penalty
Either way. On indictment, an unlimited fine; summarily, an unlimited fine in England and Wales and a fine up to the statutory maximum in Scotland and Northern Ireland (s.196(2)). No custodial sentence.
Defences
No statutory defence.
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
Sch 15, para 15
Obstructing the execution of a warrant
Fine only
Intentionally obstructing a person executing a warrant of entry and inspection issued under Schedule 15, failing without reasonable excuse to give them the assistance they reasonably require, or making a statement in response to their requirements that is false in a material respect, knowingly or recklessly.
Mental element
Intention, or knowledge or recklessness for false statements
Penalty
Summary only. An unlimited fine in England and Wales; a fine up to level 5 on the standard scale in Scotland and Northern Ireland (s.196(1)). No custodial sentence.
Defences
No statutory defence.
Prosecutor
The regulator, or with the consent of the Director of Public Prosecutions, in England and Wales; the regulator or the DPP for Northern Ireland in Northern Ireland; the Procurator Fiscal in Scotland (s.197).
Altering etc. records with intent to prevent disclosure
Fine only
Where a request has been made and the applicant would have been entitled to the information, it is an offence for the authority, or a person employed by it, an officer of it or subject to its direction, to alter, deface, block, erase, destroy or conceal any record held by the authority with the intention of preventing its disclosure.
Mental element
Intention to prevent disclosure
Penalty
Fine not exceeding level 5 on the standard scale; summary only
Altering etc. records with intent to prevent disclosure
Fine only
Where a request has been made and the applicant would have been entitled to the information, it is an offence for the authority, or a person employed by it, an officer of it or subject to its direction, to alter, deface, block, erase, destroy or conceal any record held by the authority with the intention of preventing its disclosure.
Mental element
Intention to prevent disclosure
Penalty
Fine not exceeding level 5 on the standard scale; summary only
Defences
No statutory defence.
Prosecutor
The Information Commission, or with the consent of the DPP, in England and Wales; the Commission or the DPP for Northern Ireland in Northern Ireland.
Altering etc. records with intent to prevent disclosure
Fine only
Where a request has been made and the applicant would have been entitled to the information, it is an offence for the authority, or a person employed by it, an officer of it or subject to its direction, to alter, deface, block, erase, destroy or conceal a record held by the authority with the intention of preventing its disclosure.
Mental element
Intention to prevent disclosure
Penalty
Fine not exceeding level 5 on the standard scale; summary only
Altering etc. records with intent to prevent disclosure
Fine only
Where a request has been made and the applicant would have been entitled to the information, it is an offence for the public authority, or a person employed by it, an officer of it or subject to its direction, to alter, deface, block, erase, destroy or conceal any record held by the authority with the intention of preventing its disclosure. The FOI counterpart of DPA 2018 s.173.
Mental element
Intention to prevent disclosure
Penalty
Fine not exceeding level 5 on the standard scale (unlimited in England and Wales); summary only
Defences
No statutory defence.
Prosecutor
The Information Commission, or with the consent of the Director of Public Prosecutions, in England and Wales; the Commission or the DPP for Northern Ireland in Northern Ireland (s.77(4)).