Regulation (EU) 2016/679 of the European Parliament and of the CouncilShow full title

[F1 ANNEX 1 U.K. LAWFULNESS OF PROCESSING: RECOGNISED LEGITIMATE INTERESTS

Textual Amendments

F1 Annex 1 inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 4; S.I. 2026/82, reg. 2(z6)

1 U.K. Disclosure for purposes of processing described in Article 6(1)(e)

This condition is met where—

(a) the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and

(b) the request states that the other person needs the personal data for the purposes of carrying out processing described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3).

2 U.K. National security, public security and defence

This condition is met where the processing is necessary—

(a) for the purposes of safeguarding national security,

(b) for the purposes of protecting public security, or

(c) for defence purposes.

3 U.K. Emergencies

This condition is met where the processing is necessary for the purposes of responding to an emergency.

4 U.K.

In paragraph 3, “emergency” has the same meaning as in Part 2 of the Civil Contingencies Act 2004.

5 U.K. Crime

This condition is met where the processing is necessary for the purposes of—

(a) detecting, investigating or preventing crime, or

(b) apprehending or prosecuting offenders.

6 U.K. Safeguarding vulnerable individuals

This condition is met where the processing is necessary for the purposes of safeguarding a vulnerable individual.

7 U.K.

In paragraph 6—

• “safeguarding”, in relation to a vulnerable individual, means—

  (a)

  protecting a vulnerable individual from neglect or physical, mental or emotional harm, or

  (b)

  protecting the physical, mental or emotional well-being of a vulnerable individual;

• “vulnerable individual” means an individual—

  (a)

  aged under 18, or

  (b)

  aged 18 or over and at risk.

8 U.K.

For the purposes of paragraph 7—

(a) protection of an individual, or of the well-being of an individual, includes both protection relating to a particular individual and protection relating to a type of individual, and

(b) an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(i) has needs for care and support,

(ii) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(iii) as a result of those needs is unable to protect themselves against the neglect, harm or risk.]

[F2 ANNEX 2 U.K. PURPOSE LIMITATION: PROCESSING TO BE TREATED AS COMPATIBLE WITH ORIGINAL PURPOSE

Textual Amendments

F2 Annex 2 inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 5; S.I. 2026/82, reg. 2(z7)

1 U.K. Disclosure for purposes of processing described in Article 6(1)(e)

This condition is met where—

(a) the processing—

(i) is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and

(ii) is not carried out by a public authority in the performance of its tasks, and

(b) the request states that the other person needs the personal data for the purposes of carrying out processing that—

(i) is described in Article 6(1)(e),

(ii) has a legal basis that satisfies Article 6(3), and

(iii) is necessary to safeguard an objective listed in Article 23(1)(c) to (j).

2 U.K. Disclosure for the purposes of archiving in the public interest

This condition is met where—

(a) the processing—

(i) is necessary for the purposes of making a disclosure of personal data to another person (“R”) in response to a request from R, and

(ii) is carried out in accordance with Article 84B,

(b) the controller in relation to the processing collected the personal data based on Article 6(1)(a) (data subject’s consent),

(c) the request from R states that R intends to process the personal data only for the purposes of archiving in the public interest, and

(d) the controller reasonably believes that R will carry out that processing in accordance with generally recognised standards relevant to R’s archiving in the public interest.

3 U.K. Public security

This condition is met where the processing is necessary for the purposes of protecting public security.

4 U.K. Emergencies

This condition is met where the processing is necessary for the purposes of responding to an emergency.

5 U.K.

In paragraph 4, “emergency” has the same meaning as in Part 2 of the Civil Contingencies Act 2004.

6 U.K. Crime

This condition is met where the processing is necessary for the purposes of—

(a) detecting, investigating or preventing crime, or

(b) apprehending or prosecuting offenders.

7 U.K. Protection of vital interests of data subjects and others

This condition is met where the processing is necessary for the purposes of protecting the vital interests of the data subject or another individual.

8 U.K. Safeguarding vulnerable individuals

This condition is met where the processing is necessary for the purposes of safeguarding a vulnerable individual.

9 U.K.

In paragraph 8—

• “safeguarding”, in relation to a vulnerable individual, means —

  (a)

  protecting a vulnerable individual from neglect or physical, mental or emotional harm, or

  (b)

  protecting the physical, mental or emotional well-being of a vulnerable individual;

• “vulnerable individual” means an individual—

  (a)

  aged under 18, or

  (b)

  aged 18 or over and at risk.

10 U.K.

For the purposes of paragraph 9—

(a) protection of an individual, or of the well-being of an individual, includes both protection relating to a particular individual and protection relating to a type of individual, and

(b) an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(i) has needs for care and support,

(ii) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(iii) as a result of those needs is unable to protect themselves against the neglect, harm or risk.

11 U.K. Taxation

This condition is met where the processing is necessary for the purposes of the assessment or collection of a tax or duty or an imposition of a similar nature.

12 U.K. Legal obligations

This condition is met where the processing is necessary for the purposes of complying with an obligation of the controller under an enactment, a rule of law or an order of a court or tribunal.]