Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 27 is up to date with all changes known to be in force on or before 29 October 2025. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 2General processing
CHAPTER 3Exemptions for manual unstructured processing and for national security and defence purposes
Exemptions etc
27National security: certificate
(1)
Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 26(2) is, or at any time was, required in relation to any personal data for the purpose of safeguarding national security is conclusive evidence of that fact.
(2)
A certificate under subsection (1)—
(a)
may identify the personal data to which it applies by means of a general description, and
(b)
may be expressed to have prospective effect.
(3)
Any person directly affected by a certificate under subsection (1) may appeal to the Tribunal against the certificate.
(4)
If, on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing a certificate, the Tribunal may—
(a)
allow the appeal, and
(b)
quash the certificate.
(5)
Where, in any proceedings under or by virtue of F1the UK GDPR or this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.
(6)
But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.
(7)
On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.
(8)
A document purporting to be a certificate under subsection (1) is to be—
(a)
received in evidence, and
(b)
deemed to be such a certificate unless the contrary is proved.
(9)
A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
(a)
in any legal proceedings, evidence of that certificate;
(b)
in any legal proceedings in Scotland, sufficient evidence of that certificate.
(10)
The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
(a)
a Minister who is a member of the Cabinet, or
(b)
the Attorney General or the Advocate General for Scotland.