Legislation – Data Protection Act 2018

Data Protection Act 2018, Paragraph 20 is up to date with all changes known to be in force on or before 12 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.

View outstanding changes

Changes and effects yet to be applied to Schedule 1 Paragraph 20:

s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)

Changes and effects yet to be applied to the whole Act associated Parts and Chapters:

Whole provisions yet to be inserted into this Act (including any effects on those provisions):

s. 26(2)(f)(ai) omitted by 2025 c. 18 Sch. 10 para. 9
s. 44(1)(da) inserted by 2025 c. 18 Sch. 10 para. 10(2)(a)
s. 44(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 10(3)(a)
s. 45(2)(ea) inserted by 2025 c. 18 Sch. 10 para. 11(2)(a)
s. 45(5)(ca) inserted by 2025 c. 18 Sch. 10 para. 11(3)(a)
s. 45A(2)(ca) inserted by 2025 c. 18 Sch. 10 para. 12
s. 48(1)(b)(iia) inserted by 2025 c. 18 Sch. 10 para. 13(2)(a)
s. 48(4)(ba) inserted by 2025 c. 18 Sch. 10 para. 13(3)(a)
s. 149(5A) inserted by 2025 c. 18 Sch. 10 para. 16(3)
s. 157(4A) inserted by 2025 c. 18 Sch. 10 para. 18
s. 187(2)(za) inserted by 2025 c. 18 Sch. 10 para. 21(3)(a)
Sch. 3 para. 8(1)(y) added by 2022 c. 18 (N.I.) Sch. 3 para. 78(3)

SCHEDULES

SCHEDULE 1Special categories of personal data and criminal convictions etc data

PART 2Substantial public interest conditions

Insurance

20 (1)

This condition is met if the processing—

(a)

is necessary for an insurance purpose,

(b)

is of personal data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, genetic data or data concerning health, and

(c)

is necessary for reasons of substantial public interest,

subject to sub-paragraphs (2) and (3).

(2)

Sub-paragraph (3) applies where—

(a)

the processing is not carried out for the purposes of measures or decisions with respect to the data subject, and

(b)

the data subject does not have and is not expected to acquire—

(i)

rights against, or obligations in relation to, a person who is an insured person under an insurance contract to which the insurance purpose mentioned in sub-paragraph (1)(a) relates, or

(ii)

other rights or obligations in connection with such a contract.

(3)

Where this sub-paragraph applies, the processing does not meet the condition in sub-paragraph (1) unless, in addition to meeting the requirements in that sub-paragraph, it can reasonably be carried out without the consent of the data subject.

(4)

For the purposes of sub-paragraph (3), processing can reasonably be carried out without the consent of the data subject only where—

(a)

the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b)

the controller is not aware of the data subject withholding consent.

(5)

In this paragraph—

“insurance contract” means a contract of general insurance or long-term insurance;

“insurance purpose” means—

(a)

advising on, arranging, underwriting or administering an insurance contract,

(b)

administering a claim under an insurance contract, or

(c)

exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.

(6)

The reference in sub-paragraph (4)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

(7)

Terms used in the definition of “insurance contract” in sub-paragraph (5) and also in an order made under section 22 of the Financial Services and Markets Act 2000 (regulated activities) have the same meaning in that definition as they have in that order.