PART 3

Law enforcement processing
CHAPTER 6

Supplementary

National security exemption
78A
1
A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.
2
The provisions are—
a
Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);
b
Chapter 3 of this Part (rights of the data subject);
c
in Chapter 4 of this Part—
i
section 67 (notification of personal data breach to the Commissioner);
ii
section 68 (communication of personal data breach to the data subject);
d
Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);
e
in Part 5—
i
section 119 (inspection in accordance with international obligations);
ii
in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;
f
in Part 6—
i
sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);
ii
sections 170 to 173 (offences relating to personal data);
g
in Part 7, section 187 (representation of data subjects).
3
The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
a
section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
b
section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
c
section 42 (safeguards: sensitive processing);
d
Schedule 8 (conditions for sensitive processing).
4
The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
a
the following provisions of section 73—
i
subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
ii
subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
b
section 78 (subsequent transfers).
S. 78A inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(7), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)