Data Protection Act 2018

CHAPTER 6 U.K. Supplementary

[F1 78A National security exemption U.K.

(1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

(2) The provisions are—

(a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);

(b) Chapter 3 of this Part (rights of the data subject);

(c) in Chapter 4 of this Part—

(i) section 67 (notification of personal data breach to the Commissioner);

(ii) section 68 (communication of personal data breach to the data subject);

(d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);

(e) in Part 5—

(i) section 119 (inspection in accordance with international obligations);

(ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;

(f) in Part 6—

(i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);

(ii) sections 170 to 173 (offences relating to personal data);

(g) in Part 7, section 187 (representation of data subjects).

(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

(a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;

(b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);

(c) section 42 (safeguards: sensitive processing);

(d) Schedule 8 (conditions for sensitive processing).

(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

(a) the following provisions of section 73—

(i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);

(ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);

(b) section 78 (subsequent transfers).]

Textual Amendments

F1 S. 78A inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(7), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

79 National security: certificate U.K.

F2 (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F2 (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F2 (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F3 (3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.]

(4) A certificate issued under [F4 subsection (3A)—

(a) may identify the personal data to which it applies by means of a general description, and

(b)] may be expressed to have prospective effect.

(5) Any person directly affected by the issuing of a certificate under [F5 subsection (3A)] may appeal to the Tribunal against the certificate.

(6) If, on an appeal under subsection (5), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may —

(a) allow the appeal, and

(b) quash the certificate.

(7) Where in any proceedings under or by virtue of this Act, it is claimed by a controller that [F6 a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data], any other party to the proceedings may appeal to the Tribunal on the ground that [F7 the certificate does not apply to the personal data in question].

(8) But, subject to any determination under subsection (9), [F8 the certificate] is to be conclusively presumed [F9 so to apply].

(9) On an appeal under subsection (7), the Tribunal may determine that the certificate does not so apply.

(10) A document purporting to be a certificate under [F10 subsection (3A)] is to be—

(a) received in evidence, and

(b) deemed to be such a certificate unless the contrary is proved.

(11) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under [F11 subsection (3A)] is—

(a) in any legal proceedings, evidence of that certificate, and

(b) in any legal proceedings in Scotland, sufficient evidence of that certificate.

(12) The power conferred by [F12 subsection (3A)] on a Minister of the Crown is exercisable only by—

(a) a Minister who is a member of the Cabinet, or

(b) the Attorney General or the Advocate General for Scotland.

F13 (13) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F2 S. 79(1)-(3) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F3 S. 79(3A) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(b), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F4 Words in s. 79(4) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F5 Words in s. 79(5) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(d), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F6 Words in s. 79(7) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(e)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F7 Words in s. 79(7) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(e)(ii), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F8 Words in s. 79(8) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(f)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F9 Words in s. 79(8) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(f)(ii), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F10 Words in s. 79(10) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(g), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F11 Words in s. 79(11) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(h), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F12 Words in s. 79(12) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

F13 S. 79(13) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(j), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

Commencement Information

I1 S. 79 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

80 Special processing restrictions U.K.

(1) Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to [F14 a non-UK recipient].

(2) In this section—

• F15 ...

• “[F16 non-UK recipient]” means—

  (a)

  a recipient in a third country, or

  (b)

  an international organisation.

(3) The controller must consider whether, if the personal data had instead been transmitted or otherwise made available within the United Kingdom to another competent authority, processing of the data by the other competent authority would have been subject to any restrictions by virtue of any enactment or rule of law.

(4) Where that would be the case, the controller must inform [F17 the non-UK recipient] that the data is transmitted or otherwise made available subject to compliance by that person with the same restrictions (which must be set out in the information given to that person).

F18 (5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F18 (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F18 (7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F14 Words in s. 80(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F15 Words in s. 80(2) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F16 Words in s. 80(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F17 Words in s. 80(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F18 S. 80(5)(6)(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I2 S. 80 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

81 Reporting of infringements U.K.

(1) Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part.

(2) The mechanisms implemented under subsection (1) must provide that an infringement may be reported to any of the following persons—

(a) the controller;

(b) the Commissioner.

(3) The mechanisms implemented under subsection (1) must include—

(a) raising awareness of the protections provided by Part 4A of the Employment Rights Act 1996 and Part 5A of the Employment Rights (Northern Ireland) Order 1996 (S.I. 1996/1919 (N.I. 16)), and

(b) such other protections for a person who reports an infringement of this Part as the controller considers appropriate.

(4) A person who reports an infringement of this Part does not breach—

(a) an obligation of confidence owed by the person, or

(b) any other restriction on the disclosure of information (however imposed).

(5) Subsection (4) does not apply if or to the extent that the report includes a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(6) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (5) has effect as if it included a reference to that Part.

Commencement Information

I3 S. 81 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)