Data Protection Act (2021 Revision) - Section 40 Consultation Form

Summary

This is a fillable consultation form used by data controllers to seek the Ombudsman's input under Section 40 of the Data Protection Act (2021 Revision) before adopting administrative measures or rules that involve the processing of personal data. It structures the information a controller must provide so the Ombudsman can assess the proposal's data protection implications.

• Controller and contact details: Name of the data controller and the main contact person's details.
• Description of the measures: Title or summary of the proposed administrative measures or rules and the type of personal data processing involved.
• Need for consultation: Explanation of the aims and scope of the measures and why Ombudsman consultation is warranted, with supporting documents in appendix if helpful.
• Impact on individuals: Assessment of individual control over their data, effects on children or vulnerable groups, prior concerns, novelty (e.g. new technology), and public interest issues.
• Scope of data: Nature of personal data involved, whether sensitive data is included, collection and retention practices, and the number of individuals likely affected.
• Compliance and proportionality: Consideration of less intrusive alternatives, risk of purpose expansion, data quality and minimization measures, and how individuals will be informed and assisted in exercising their rights.
• Context and purpose: The intended effect and broader benefits of the measures, alongside the same impact and novelty considerations noted above.

The form itself does not set a filing deadline; it is submitted whenever a data controller is required or chooses to consult the Ombudsman under Section 40 prior to implementing the measures or rules in question.

Key obligations

• Data controllers proposing administrative measures or rules involving personal data processing that require prior consultation under Section 40 of the Data Protection Act must complete and submit this consultation form to the Ombudsman, describing the measures, their impact, the scope of data involved, and compliance/proportionality safeguards.

Applies to

data controllers