http://www.legislation.gov.uk/ukpga/2018/12/section/35/enactedData Protection Act 2018enKing's Printer of Acts of Parliament2024-03-26
Data Protection Act 2018s. 26(2)(f)(ai)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(4)reg. 1(2)Data Protection Act 2018Sch. 3 para. 8(1)(y)Adoption and Children Act (Northern Ireland) 2022Sch. 3 para. 78(3)s. 160(1)
PART 3Law enforcement processingCHAPTER 2PrinciplesThe first data protection principle
35
1
The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.
2
The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—
a
the data subject has given consent to the processing for that purpose, or
b
the processing is necessary for the performance of a task carried out for that purpose by a competent authority.
3
In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).
4
The first case is where—
a
the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and
b
at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
5
The second case is where—
a
the processing is strictly necessary for the law enforcement purpose,
b
the processing meets at least one of the conditions in Schedule 8, and
c
at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
6
The Secretary of State may by regulations amend Schedule 8—
a
by adding conditions;
b
by omitting conditions added by regulations under paragraph (a).
7
Regulations under subsection (6) are subject to the affirmative resolution procedure.
8
In this section, “sensitive processing” means—
a
the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
b
the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;
c
the processing of data concerning health;
d
the processing of data concerning an individual’s sex life or sexual orientation.