Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 86 is up to date with all changes known to be in force on or before 02 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 4Intelligence services processing
CHAPTER 2Principles
The data protection principles
86The first data protection principle
(1)
The first data protection principle is that the processing of personal data must be—
(a)
lawful, and
(b)
fair and transparent.
(2)
The processing of personal data is lawful only if and to the extent that—
(a)
at least one of the conditions in Schedule 9 is met, and
(b)
in the case of sensitive processing, at least one of the conditions in Schedule 10 is also met.
(3)
The Secretary of State may by regulations amend Schedule 10—
(a)
by adding conditions;
(b)
by F1varying or omitting conditions added by regulations under paragraph (a).
(4)
Regulations under subsection (3) are subject to the affirmative resolution procedure.
(5)
In determining whether the processing of personal data is fair and transparent, regard is to be had to the method by which it is obtained.
(6)
For the purposes of subsection (5), data is to be treated as obtained fairly and transparently if it consists of information obtained from a person who—
(a)
is authorised by an enactment to supply it, or
(b)
is required to supply it by an enactment or by an international obligation of the United Kingdom.
(7)
In this F2Part, “sensitive processing” means—
(a)
the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
(b)
the processing of genetic data for the purpose of uniquely identifying an individual;
(c)
the processing of biometric data for the purpose of uniquely identifying an individual;
(d)
the processing of data concerning health;
(e)
the processing of data concerning an individual’s sex life or sexual orientation;
(f)
the processing of personal data as to—
(i)
the commission or alleged commission of an offence by an individual, or
(ii)
proceedings for an offence committed or alleged to have been committed by an individual, the disposal of such proceedings or the sentence of a court in such proceedings.