Legislation – Data Protection Act 2018

Data Protection Act 2018, CHAPTER 2 is up to date with all changes known to be in force on or before 02 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

PART 2General processing

Lawfulness of processing

8Lawfulness of processing: public interest etc

In Article 6(1) of the F12UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of F13… official authority includes processing of personal data that is necessary for—

(a)

the administration of justice,

(b)

the exercise of a function of either House of Parliament,

(c)

the exercise of a function conferred on a person by an enactment or rule of law,

(d)

the exercise of a function of the Crown, a Minister of the Crown or a government department, or

(e)

an activity that supports or promotes democratic engagement.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F15Relevant international law

9AProcessing in reliance on relevant international law

(1)

Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.

(2)

A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.

(3)

The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—

(a)

conditions,

(b)

provision about the purposes for which a condition may be relied on, and

(c)

safeguards in connection with processing carried out in reliance on a condition in the Schedule.

(4)

Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.

(5)

Regulations under this section are subject to the affirmative resolution procedure.

(6)

In this section, “treaty” and “ratified” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).

Special categories of personal data

10Special categories of personal data and criminal convictions etc data

(1)

Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the F16UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—

(a)

point (b)
(employment, social security and social protection);

(b)

point (g)
(substantial public interest);

(c)

point (h)
(health and social care);

(d)

point (i)
(public health);

(e)

point (j)
(archiving, research and statistics).

(2)

The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the F17UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.

(3)

The processing meets the requirement in point (g) of Article 9(2) of the F18UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.

(4)

Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5)

The processing meets the requirement in Article F1910(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.

(6)

The Secretary of State may by regulations—

(a)

amend Schedule 1—

(i)

by adding or varying conditions or safeguards, and

(ii)

by omitting conditions or safeguards added by regulations under this section, and

(b)

consequentially amend this section.

(7)

Regulations under this section are subject to the affirmative resolution procedure.

11Special categories of personal data etc: supplementary

(1)

For the purposes of Article 9(2)(h) of the F20UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the F20UK GDPR (obligation of secrecy) include circumstances in which it is carried out—

(a)

by or under the responsibility of a health professional or a social work professional, or

(b)

by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

(2)

In Article 10 of the F21UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—

(a)

the alleged commission of offences by the data subject, or

(b)

proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.

Rights of the data subject

12Limits on fees that may be charged by controllers

(1)

The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—

(a)

Article 12(5) of the F22UK GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or

(b)

Article 15(3) of the F23UK GDPR (reasonable fees for provision of further copies).

(2)

The Secretary of State may by regulations—

(a)

require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and

(b)

specify what the guidance must include.

(3)

Regulations under this section are subject to the negative resolution procedure.

13Obligations of credit reference agencies

(1)

This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).

(2)

The controller’s obligations under Article 15(1) to (3) of the F24UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject’s financial standing, unless the data subject has indicated a contrary intention.

(3)

Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the F25UK GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject’s rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).

F2613AMeaning of “relevant offence” for purpose of right to erasure

(1)

The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.

(2)

Regulations under this section are subject to the affirmative resolution procedure.

F2714Automated decision-making authorised by law: safeguards

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F28Exemptions etc

15Exemptions etc

(1)

Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the F29UK GDPR.

(2)

In Schedule 2—

(a)

Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the F30UK GDPR in specified circumstances F31(of a kind described in Article 6(3) and Article 23(1) of the F32UK GDPR);

(b)

Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the F33UK GDPR in specified circumstances F34(of a kind described in Article 23(1) of the F35UK GDPR);

(c)

Part 3 makes provision restricting the application of Article 15 of the F36UK GDPR where this is necessary to protect the rights of others F37(of a kind described in Article 23(1) of the F38UK GDPR);

(d)

Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the F39UK GDPR in specified circumstances F40(of a kind described in Article 23(1) of the F41UK GDPR);

(e)

Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV F42and V of the UK GDPR for reasons relating to freedom of expression F43(of a kind described in Article 85(2) of the UK GDPR);

(f)

Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the F44UK GDPR for scientific or historical research purposes, statistical purposes and archiving purposes F45….

(3)

Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the F46UK GDPR to health, social work, education and child abuse data F47(of a kind described in Article 23(1) of the F48UK GDPR).

(4)

Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the F49UK GDPR to information the disclosure of which is prohibited or restricted by an enactment F50(of a kind described in Article 23(1) of the F51UK GDPR).

F52(4A)

In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).

(5)

In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part F53(sections 26 to 28).

16Power to make further exemptions etc by regulations

(1)

The following powers to make provision altering the application of the F54UK GDPR may be exercised by way of regulations made by the Secretary of State under this section—

(a)

the power in Article 6(3) F55… to lay down a legal basis containing specific provisions to adapt the application of rules of the F56UK GDPR where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;

(b)

the power in Article 23(1) to make F57provision restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;

(c)

the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the F58UK GDPR where necessary to reconcile the protection of personal data with the freedom of expression and information.

(2)

Regulations under this section may—

(a)

amend Schedules 2 to 4—

(i)

by adding or varying provisions, and

(ii)

by omitting provisions added by regulations under this section, F59…

(b)

consequentially amend section 15 F60, and

(c)

consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.

(3)

Regulations under this section are subject to the affirmative resolution procedure.

F61Certification

17Accreditation of certification providers

(1)

Accreditation of a person as a certification provider is only valid when carried out by—

(a)

the Commissioner, or

(b)

the F62UK national accreditation body.

(2)

The Commissioner may only accredit a person as a certification provider where the Commissioner—

(a)

has published a statement that the Commissioner will carry out such accreditation, and

(b)

has not published a notice withdrawing that statement.

(3)

The F63UK national accreditation body may only accredit a person as a certification provider where the Commissioner—

(a)

has published a statement that the body may carry out such accreditation, and

(b)

has not published a notice withdrawing that statement.

(4)

The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.

(5)

Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.

(6)

The F64UK national accreditation body may charge a reasonable fee in connection with, or incidental to, the carrying out of the body’s functions under this section, Schedule 5 and Article 43 of the F65UK GDPR.

(7)

The F66UK national accreditation body must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the F67UK GDPR as the Secretary of State may reasonably require.

(8)

In this section—

“certification provider” means a person who issues certification for the purposes of Article 42 of the F68UK GDPR;

“the F69UK national accreditation body” means the F69UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.

Changes to legislation:

Changes to Legislation

PART 2General processing

CHAPTER 2F1 The UK GDPR

Meaning of certain terms used in the F2UK GDPR

6Meaning of “controller”

(1)

(a)

(b)

(c)

(2)

(a)

(b)

7Meaning of “public authority” and “public body”

(1)

(a)

(b)

F8(ba)

(c)

(2)

(3)

(a)

(b)

(c)

(d)

(e)

(f)

(i)

(ii)

(iii)

(4)

(5)

Lawfulness of processing

8Lawfulness of processing: public interest etc

(a)

(b)

(c)

(d)

(e)

F149Child’s consent in relation to information society services

F15Relevant international law

9AProcessing in reliance on relevant international law

(1)

(2)

(3)

(a)

(b)

(c)

(4)

(5)

(6)

Special categories of personal data

10Special categories of personal data and criminal convictions etc data

(1)

(a)

(b)

(c)

(d)

(e)

(2)

(3)

(4)

(5)

(6)

(a)

(i)

(ii)

(b)

(7)

11Special categories of personal data etc: supplementary

(1)

(a)

(b)

(2)

(a)

(b)

Rights of the data subject

12Limits on fees that may be charged by controllers

(1)

(a)