Search Legislation

Data Protection Act 2018

 Help about what version

What Version

  • Latest available (Revised)
  • Original (As enacted)
 Help about advanced features

Advanced Features

 Help about opening options

Opening OptionsExpand opening options

Changes over time for: Cross Heading: National security certificates: processing of personal data under the 2018 Act

 Help about opening options

Changes to legislation:

Data Protection Act 2018, Cross Heading: National security certificates: processing of personal data under the 2018 Act is up to date with all changes known to be in force on or before 06 June 2025. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. Help about Changes to Legislation

National security certificates: processing of personal data under the 2018 ActU.K.

18(1)This paragraph applies to a certificate issued under section 28(2) of the 1998 Act (an “old certificate”) which has effect immediately before the relevant time.U.K.

(2)If and to the extent that the old certificate provides protection with respect to personal data which corresponds to protection that could be provided by a certificate issued under section 27, 79 or 111 of this Act, the old certificate also has effect to that extent after the relevant time as if—

(a)it were a certificate issued under one or more of sections 27, 79 and 111 (as the case may be),

(b)it provided protection in respect of that personal data in relation to the corresponding provisions of this Act or the [F1UK GDPR], and

(c)where it has effect as a certificate issued under section 79, it certified that each restriction in question is a necessary and proportionate measure to protect national security.

(3)Where an old certificate also has effect as if it were a certificate issued under one or more of sections 27, 79 and 111, that section has, or those sections have, effect accordingly in relation to the certificate.

(4)Where an old certificate has an extended effect because of sub-paragraph (2), section 130 of this Act does not apply in relation to it.

(5)An old certificate that has an extended effect because of sub-paragraph (2) provides protection only with respect to the processing of personal data that occurs during the period of 1 year beginning with the relevant time (and a Minister of the Crown may curtail that protection by wholly or partly revoking the old certificate).

(6)For the purposes of this paragraph—

(a)a reference to the protection provided by a certificate issued under—

(i)section 28(2) of the 1998 Act, or

(ii)section 27, 79 or 111 of this Act,

is a reference to the effect of the evidence that is provided by the certificate;

(b)protection provided by a certificate under section 28(2) of the 1998 Act is to be regarded as corresponding to protection that could be provided by a certificate under section 27, 79 or 111 of this Act where, in respect of provision in the 1998 Act to which the certificate under section 28(2) relates, there is corresponding provision in this Act or the [F2UK GDPR] to which a certificate under section 27, 79 or 111 could relate.

(7)In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.

[F3(8)In this paragraph, references to the UK GDPR do not include the EU GDPR as it was directly applicable to the United Kingdom before IP completion day (see paragraph 2 of Schedule 21).]

Back to top

Options/Help

You have chosen to open The Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open The Whole Act as a PDF

The Whole Act you have selected contains over 200 provisions and might take some time to download.

Would you like to continue?

You have chosen to open the Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open the Whole Act without Schedules

The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open Schedules only

The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?