Data (Use and Access) Act 2025

Prospective

88 National security exemption U.K.

(1) The 2018 Act is amended in accordance with subsections (2) to (10).

(2) In section 26(2)(f) (national security and defence exemption), before sub-paragraph (i) insert—

“(ai) Article 77 (right to lodge a complaint with the Commissioner);”.

(3) In section 44 (controller’s general duties to provide information to data subject)—

(a) in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),

(b) in subsection (5), after “restricted” insert “under subsection (4)”, and

(c) in subsection (7)(a), after “subsection (2)” insert “in reliance on subsection (4)”.

(4) In section 45 (right of access by the data subject)—

(a) in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),

(b) in subsection (5), after “restricted” insert “under subsection (4)”, and

(c) in subsection (7)(a), after “subsection (1)” insert “in reliance on subsection (4)”.

(5) In section 48 (requests by data subject for rectification or erasure of personal data)—

(a) in subsection (3), omit paragraph (d) (grounds for restricting information provided: national security),

(b) in subsection (4)—

(i) for “(1)” substitute “(1)(b)(i)”, and

(ii) after “restricted” insert “under subsection (3)”, and

(c) in subsection (6)(a), after “subsection (1)(b)(i)” insert “in reliance on subsection (3)”.

(6) In section 68(7) (communication of a personal data breach to the data subject: grounds for restricting information provided), omit paragraph (d) (national security).

(7) In Chapter 6 of Part 3 (law enforcement processing: supplementary), before section 79 insert—

“78A National security exemption

(1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

(2) The provisions are—

(a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);

(b) Chapter 3 of this Part (rights of the data subject);

(c) in Chapter 4 of this Part—

(i) section 67 (notification of personal data breach to the Commissioner);

(ii) section 68 (communication of personal data breach to the data subject);

(d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);

(e) in Part 5—

(i) section 119 (inspection in accordance with international obligations);

(ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;

(f) in Part 6—

(i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);

(ii) sections 170 to 173 (offences relating to personal data);

(g) in Part 7, section 187 (representation of data subjects).

(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

(a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;

(b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);

(c) section 42 (safeguards: sensitive processing);

(d) Schedule 8 (conditions for sensitive processing).

(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

(a) the following provisions of section 73—

(i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);

(ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);

(b) section 78 (subsequent transfers).”

(8) In section 79 (national security: certificate)—

(a) omit subsections (1) to (3),

(b) after subsection (3) insert—

“(3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.”,

(c) in subsection (4), for “subsection (1)” substitute “subsection (3A)—

“(a) may identify the personal data to which it applies by means of a general description, and

(b)” ,

(d) in subsection (5), for “subsection (1)” substitute “subsection (3A)”,

(e) in subsection (7)—

(i) for “a restriction falls within a general description in a certificate issued under subsection (1)” substitute “a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data”, and

(ii) for “the restriction does not fall within that description” substitute “the certificate does not apply to the personal data in question”,

(f) in subsection (8)—

(i) for “the restriction” substitute “the certificate”, and

(ii) for “to fall within the general description” substitute “so to apply”,

(g) in subsection (10), for “subsection (1)” substitute “subsection (3A)”,

(h) in subsection (11), for “subsection (1)” substitute “subsection (3A)”,

(i) in subsection (12), for “subsection (1)” substitute “subsection (3A)”, and

(j) omit subsection (13).

(9) In section 110(2) (intelligence services processing: national security)—

(a) in paragraph (a), after “Chapter 2” insert “of this Part”,

(b) in paragraph (b), after “Chapter 3” insert “of this Part”, and

(c) in paragraph (c), after “Chapter 4” insert “of this Part”.

(10) In section 186(3) (data subject’s rights etc: exceptions), after paragraph (c) insert—

“(ca) in Part 3 of this Act, section 78A, and”.

(11) In the provisions listed in subsection (12), for “subsection (4) of that section” substitute “section 45(4) or 78A of that Act”.

(12) The provisions are—

(a) section 40(4A)(b) and (5B)(d) of the Freedom of Information Act 2000 (personal data which is exempt information);

(b) section 38(3A)(b) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);

(c) regulation 13(3A)(b) and (5B)(d) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);

(d) regulation 11(4A)(b) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);

(e) regulation 45(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);

(f) regulation 39(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information).

Commencement Information

I1 S. 88 not in force at Royal Assent, see s. 142(1)