Personal Data Protection Act 2010 · Updated to 15 Sep 2026 · Part VIII · Inspection, Complaint and Investigation
101. Inspection of personal data system
Feedback & supportThe Commissioner may carry out an inspection of—
Commissioner
“Commissioner” means the Personal Data Protection Commissioner appointed under section 47;
any personal data system used by data controllers for the purpose of ascertaining information to assist the
Commissioner in making recommendations to the relevant data controller relating to the promotion of compliance with the provisions of this Act, in particular the Personal
Data Protection Principles, by the relevant data controller;
or
any personal data system used by data controllers belonging to a class of data controllers for the purpose of ascertaining information to assist the Commissioner in making recommendations to the class of data controllers to which the relevant data controller belongs relating to the promotion of compliance with the provisions of this
Act, in particular the Personal Data Protection Principles, by the class of data controllers to which the relevant data controller belongs.
72
For the purposes of this section—
“data controller” includes a data processor;
data processor
“data processor”, in relation to personal data, means any person, other than an employee of the data user, who processes the personal data solely on behalf of the data user, and does not process the personal data for any of his own purposes;
“personal data system” means any system, whether automated or otherwise, which is used, whether in whole or in part, by a data controller for the processing of personal data, and includes the record maintained under section 44 and any document and equipment forming part of the system.
personal data
“personal data” means any information in respect of commercial transactions, which— (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010;