How to appeal a Data Protection Commission decision

A person aggrieved by a decision of the Commissioner can appeal to the Information and Data Protection Appeals Tribunal within 30 days, under section 95. The Tribunal is not new either: section 85 continues the same body that existed under the repealed 2018 Act, rather than creating a fresh one. That matters because a business or individual disagreeing with an outcome from the Commission is not left with no route beyond the regulator itself; the Act builds a separate appeal body into the structure from the start.

Who sits on the Tribunal (s.86)

Section 86 sets the Tribunal’s composition:

• A President and Vice-President, both of whom must be qualified to be appointed as High Court judges.
• Three members with expertise in data protection or access to information.
• Two members representing, respectively, the interests of data subjects and the interests of controllers.

That mix is meant to give the Tribunal both the legal standing to hear appeals against Commissioner decisions and direct input from people who understand data protection practice on both sides.

What it can hear (s.87)

Section 87 gives the Tribunal jurisdiction to hear appeals against decisions of the Commissioner. This includes appeals brought on behalf of a minor data subject, by a parent, guardian or carer acting for the child, which matters given the extra protections children get elsewhere in the Act. See children’s data.

In practice, that jurisdiction covers the kinds of decisions the Commission actually makes: the outcome of a complaint, a compliance order or processing ban issued under section 16, and the size or existence of an administrative fine under section 83 (see penalties). Anyone on the receiving end of one of these, not just the person who originally complained, can be the one appealing, since a controller or processor disputing a fine or a compliance order is exercising the same right under section 87 as a data subject disputing how their complaint was resolved.

The appeal window and what comes after (s.95, s.97)

Section 95 sets a 30-day window from a Commissioner decision to lodge an appeal with the Tribunal. That is not a long runway, so a business or individual disagreeing with a decision, whether a compliance order, a fine, or the outcome of a complaint, needs to act on it promptly rather than treating it as an open-ended option.

The Tribunal is not the end of the road either. Section 97 allows a further appeal from a Tribunal decision to the High Court, giving a second level of judicial oversight above the Commission’s own decision-making.