PART 4

Intelligence services processing
CHAPTER 1

Scope and definitions

Scope

Designation of processing by a qualifying competent authority
82A
1
For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—
a
an application for designation of the processing is made in accordance with this section, and
b
the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.
2
The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.
3
The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—
a
a country or territory outside the United Kingdom, or
b
an international organisation.
4
A designation notice must—
a
specify or describe the processing and qualifying competent authority that are designated, and
b
be given to the applicants for the designation (and see also section 82D).
5
An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—
a
the qualifying competent authority, and
b
the intelligence service with which the processing is to be carried out.
6
An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.
7
The application must—
a
describe the processing, including the intended purposes and means of processing, and
b
explain why the applicants consider that designation is required for the purposes of safeguarding national security.
8
Before giving a designation notice, the Secretary of State must consult the Commissioner.
9
In this section, “
joint controller
”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.
Ss. 82A-82E inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(3), 142(1); S.I. 2025/996, reg. 2(2)(a)