Can Reading Someone's Records at Work Be a Crime Under DPA s.170?

Yes, it can. Section 170 of the Data Protection Act 2018 makes it a criminal offence to knowingly or recklessly obtain personal data without the controller's consent, and "obtain" is read widely enough that nosing through a record you had no reason to open can fall inside it. No hacking is required, and you may have had a working login the whole time.

This is general information about the legislation, not legal advice. How it applies depends heavily on the facts.

What the offence actually says

The primary text is on legislation.gov.uk. In plain terms, a person commits an offence if they knowingly or recklessly, without the consent of the controller:

• obtain or disclose personal data;
• procure the disclosure of personal data to another person; or
• retain personal data after obtaining it, without the consent of the person who was the controller when it was obtained.

The word that matters is controller. Consent has to come from the organisation (or person) that decides why and how the data is processed, not from your manager, and not from the data subject.

Is looking at a record really "obtaining"?

This is the part people get wrong. The statute does not say "copy" or "download". The ICO's long-standing enforcement position, and the way its prosecutions have been framed, is that accessing records you have no business reason to see counts as obtaining them. That is the regulator's interpretation, applied through prosecutions and guilty pleas, so treat it as how the offence is enforced rather than a settled appellate ruling on every edge case.

The typical prosecution is not a sophisticated attacker. It is an employee at a health body, council, bank or police force with legitimate system access who looks up a neighbour, an ex-partner or a celebrity.

Quick detour: why a valid login doesn't help

Hang on, if the system let you in, surely that is consent? It isn't. A controller's consent is tied to purpose. Your account is permitted to open records for your job, and the controller has not consented to you opening them out of curiosity.

That is also why the "recklessly" limb matters. You do not need to intend harm. If you knew you had no work reason to look, or didn't care whether you did, the mental element is plausibly met.

The defences

The Act gives a set of defences, which the defendant has to prove. Paraphrasing the statute, they include showing that the obtaining, disclosing, procuring or retaining:

• was necessary for preventing or detecting crime;
• was required or authorised by an enactment, a rule of law or a court order;
• was done in the reasonable belief that you had a legal right to do it, or that the controller would have consented had they known;
• was justified as being in the public interest in the particular circumstances.

There is also a separate defence for journalistic, academic, artistic or literary purposes, with a view to publication, where there was a reasonable belief that it was justified in the public interest. Check the exact wording and subsection layout in the legislation before relying on any of this.

"I was just checking they were okay" is the sort of explanation that tends to struggle under the reasonable-belief test, particularly where there is an audit trail showing no related case, ticket or task.

What the penalty is

It is a fine-only offence: a fine on summary conviction, or an unlimited fine on indictment. There is no prison sentence for s.170 itself. That sounds mild, but a conviction can end a career in a regulated or trusted role, and the fine is not the only consequence.

• Disciplinary action or dismissal from the job.
• Possible related offences, such as unauthorised access under the Computer Misuse Act 1990 where the facts support it.
• Civil claims from the affected person, and enforcement against the employer under UK GDPR.

What this means if you run the systems

Sysadmins and developers are the group most likely to be technically able to read anything. Being able to is not the test; having a reason the controller would endorse is.

• Get production data access written down, scoped to a purpose.
• Log reads of personal data, and actually review the logs.
• Use test or masked data for debugging where you can.
• Tell staff plainly that browsing records is a disciplinary and criminal matter, not a grey area.

One related point worth knowing: s.171 separately covers re-identifying data that was de-identified, again without the controller's consent. If you work with pseudonymised datasets, that one is aimed squarely at you.

Finally, the offence is not about a data subject reading their own data. Getting your own records through a subject access request is the process working as intended. The risk is in getting someone else's, or helping someone else to.