Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 10 is up to date with all changes known to be in force on or before 02 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 2General processing
CHAPTER 2 The UK GDPR
Special categories of personal data
10Special categories of personal data and criminal convictions etc data
(1)
Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the F1UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
(a)
point (b)
(employment, social security and social protection);
(b)
point (g)
(substantial public interest);
(c)
point (h)
(health and social care);
(d)
point (i)
(public health);
(e)
point (j)
(archiving, research and statistics).
(2)
The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the F2UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
(3)
The processing meets the requirement in point (g) of Article 9(2) of the F3UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
(4)
Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
(5)
The processing meets the requirement in Article F410(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
(6)
The Secretary of State may by regulations—
(a)
amend Schedule 1—
(i)
by adding or varying conditions or safeguards, and
(ii)
by omitting conditions or safeguards added by regulations under this section, and
(b)
consequentially amend this section.
(7)
Regulations under this section are subject to the affirmative resolution procedure.