Data (Use and Access) Act 2025

74 Processing of special categories of personal data U.K.

(1) In Chapter 2 of the UK GDPR, after Article 11 insert—

“Article 11A Further provision about processing of special categories of personal data

1. The Secretary of State may by regulations—

(a) make provision so that an additional description of processing of personal data is subject to the prohibition in Article 9(1),

(b) make provision so that added processing is not subject to that prohibition,

(c) make provision so that an exception in Article 9(2) may or may not be relied on in connection with added processing, and

(d) make provision varying such an exception as it applies in connection with added processing.

2. In paragraph 1, “added processing” means a description of processing which is subject to the prohibition in Article 9(1) by virtue of provision made under paragraph 1(a).

3. Regulations made under this Article (in reliance on Article 91A(4)(b)) may amend section 5, 205 or 206 of the 2018 Act (interpretation).

4. Regulations under this Article are subject to the affirmative resolution procedure.”

(2) The 2018 Act is amended in accordance with subsections (3) to (9).

(3) In section 33 (definitions of expressions used in Part 3), after subsection (6) insert—

“(6A) “Sensitive processing” has the meaning given in section 35(8).”

(4) In section 35 (the first data protection principle)—

(a) in subsection (6)(b) (power to omit conditions added to Schedule 8 by regulations), after “by”, in the first place it occurs, insert “varying or”, and

(b) in subsection (8) (definition of “sensitive processing”), for “section” substitute “Part”.

(5) After section 42 insert—

“42A Further provision about sensitive processing

(1) The Secretary of State may by regulations—

(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b) make provision so that added processing is not sensitive processing for the purposes of this Part,

(c) make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and

(d) make provision varying such a condition as it relates to added processing.

(2) In subsection (1)—

• “added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

• “protected condition in Schedule 8” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).

(3) Regulations under this section may amend this Part and sections 205 and 206.

(4) Regulations under this section are subject to the affirmative resolution procedure.”

(6) In section 84 (definitions of expressions used in Part 4), after subsection (6) insert—

“(6A) “Sensitive processing” has the meaning given in section 86(7).”

(7) In section 86 (the first data protection principle)—

(a) in subsection (3)(b) (power to omit conditions added to Schedule 10 by regulations), after “by”, in the first place it occurs, insert “varying or”, and

(b) in subsection (7) (definition of “sensitive processing”), for “section” substitute “Part”.

(8) After section 91 insert—

“91A Further provision about sensitive processing

(1) The Secretary of State may by regulations—

(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b) make provision so that added processing is not sensitive processing for the purposes of this Part,

(c) make provision so that a protected condition in Schedule 10 may or may not be relied on in connection with added processing, and

(d) make provision varying such a condition as it relates to added processing.

(2) In subsection (1)—

• “added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

• “protected condition in Schedule 10” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).

(3) Regulations under this section may amend this Part and sections 205 and 206.

(4) Regulations under this section are subject to the affirmative resolution procedure.”

(9) In section 206 (index of defined expressions), in the Table, at the appropriate place insert—

“sensitive processing (in Parts 3 and 4)

sections 35 and 86”.

(10) The Investigatory Powers Act 2016 is amended in accordance with subsections (11) to (13).

(11) In section 202(4) (restrictions on use of class BPD warrants: definitions), omit the definition of “sensitive personal data” and insert—

• ““sensitive personal data” means personal data whose retention, or (as appropriate) retention and examination, would be sensitive processing;

• “sensitive processing” means—

  (a)

  processing of personal data relating to a living individual that is processing of a kind described in section 86(7)(a) to (e) of the Data Protection Act 2018, or

  (b)

  processing of personal data relating to a deceased individual that would be that kind of processing if the personal data related to a living individual.”

(12) After that section insert—

“202A Further provision about sensitive processing

(1) The Secretary of State may by regulations—

(a) make provision so that a description of Part 4 sensitive processing, or of processing that would be such processing if the information processed related to a living individual, is sensitive processing for the purposes of section 202, and

(b) make provision so that added processing is not sensitive processing for the purposes of that section.

(2) In this section—

• “added processing” means a description of processing that is sensitive processing for the purposes of section 202 by virtue of provision made under subsection (1)(a);

• “Part 4 sensitive processing” means processing of personal data that, at the time the regulations are made, is sensitive processing for the purposes of Part 4 of the Data Protection Act 2018 by virtue of regulations made under section 91A of that Act.

(3) Regulations under this section may amend section 202.”

(13) In section 267(3) (regulations subject to the affirmative procedure), after paragraph (e) insert—

“(ea) section 202A,”.

Commencement Information

I1 S. 74 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)