Legislation – Data (Use and Access) Act 2025

Data (Use and Access) Act 2025, Section 90 is up to date with all changes known to be in force on or before 24 October 2025. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

Part 5Data protection and privacy

Chapter 1Data protection

Intelligence services

90Joint processing: consequential amendments

(1)

The 2018 Act is amended in accordance with subsections (2) to (9).

(2)

In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”.

(3)

In section 29 (processing to which Part 3 applies), after subsection (1) insert—

“(1A)

This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).”

(4)

In section 83 (meaning of “controller” and “processor” in Part 4)—

(a)

before subsection (1) insert—

“A1

For the purposes of this Part—

(a)

an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and

(b)

a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.”,

(b)

in subsection (1), for the words before paragraph (a) substitute “This subsection is satisfied by a person who—”, and

(c)

in subsection (2), for “intelligence service on which” substitute “person on whom”.

(5)

In section 84 (other definitions)—

(a)

after subsection (2) insert—

“(2A)

“Designation notice” has the meaning given in section 82A.”, and

(b)

before subsection (7) insert—

“(6B)

“Withdrawal notice” has the meaning given in section 82C.”

(6)

In section 104(1) (joint controllers), for “intelligence services” substitute “controllers”.

(7)

In section 202(1)(a)(i) (proceedings in the First-tier Tribunal: contempt) after “79,” insert “82E,”.

(8)

In section 203(1) (Tribunal Procedure Rules), after “79,” insert “82E,”.

(9)

In section 206 (index of defined expressions), in the Table—

(a)

in the entry for “competent authority”—

(i)

for “Part 3” substitute “Parts 3 and 4”, and

(ii)

for “section 30” substitute “sections 30 and 82”, and

(b)

at the appropriate places insert—

“designation notice (in Part 4)

section 84”;

“qualifying competent authority (in Part 4)

section 82”;

“withdrawal notice (in Part 4)

section 84”.

(10)

In section 199(2)(a) of the Investigatory Powers Act 2016 (bulk personal datasets: meaning of “personal data”), after “section 82(1) of that Act” insert “by an intelligence service”.