Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 78A is up to date with all changes known to be in force on or before 09 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 6Supplementary
F178ANational security exemption
(1)
A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.
(2)
The provisions are—
(a)
Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);
(b)
Chapter 3 of this Part (rights of the data subject);
(c)
in Chapter 4 of this Part—
(i)
section 67 (notification of personal data breach to the Commissioner);
(ii)
section 68 (communication of personal data breach to the data subject);
(d)
Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);
(e)
in Part 5—
(i)
section 119 (inspection in accordance with international obligations);
(ii)
in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;
(f)
in Part 6—
(i)
sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);
(ii)
sections 170 to 173 (offences relating to personal data);
(g)
in Part 7, section 187 (representation of data subjects).
(3)
The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
(a)
section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
(b)
section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
(c)
section 42 (safeguards: sensitive processing);
(d)
Schedule 8 (conditions for sensitive processing).
(4)
The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
(a)
the following provisions of section 73—
(i)
subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
(ii)
subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
(b)
section 78 (subsequent transfers).