Legalize / United Kingdom / Public General Act

Data Protection Act 2018

Type Public General Act

Publication 2018-05-23

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles 2

Reform history JSON API

(7) This section applies in relation to amendments prepared under section 191 as it applies in relation to a document prepared under that section.

Publication and review of the Framework

193

(1) The Secretary of State must publish a document issued under section 192(3).

(2) Where an amendment of a document is issued under section 192(3), the Secretary of State must publish—

(a) the amendment, or

(b) the document as amended by it.

(3) The Secretary of State must keep under review the document issued under section 192(3) for the time being in force.

(4) Where the Secretary of State becomes aware that the terms of such a document could result in a breach of an international obligation of the United Kingdom, the Secretary of State must exercise the power under section 191(4) with a view to remedying the situation.

Effect of the Framework

194

(1) When carrying out processing of personal data which is the subject of a document issued under section 192(3) which is for the time being in force, a person must have regard to the document.

(2) A failure to act in accordance with a provision of such a document does not of itself make a person liable to legal proceedings in a court or tribunal.

(3) A document issued under section 192(3), including an amendment or replacement document, is admissible in evidence in legal proceedings.

(4) In any legal proceedings before a court or tribunal, the court or tribunal must take into account a provision of any document issued under section 192(3) in determining a question arising in the proceedings if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to the court or tribunal to be relevant to the question.

(5) In determining a question arising in connection with the carrying out of any of the Commissioner's functions, the Commissioner must take into account a provision of a document issued under section 192(3) if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to the Commissioner to be relevant to the question.

195

(1) The Reserve Forces Act 1996 is amended as follows.

(2) After section 125 insert—

(125A) (1) This subsection applies to contact details for— (a) a member of an ex-regular reserve force, or (b) a person to whom section 66 (officers and former servicemen liable to recall) applies, which are held by HMRC in connection with a function of HMRC. (2) HMRC may supply contact details to which subsection (1) applies to the Secretary of State for the purpose of enabling the Secretary of State— (a) to contact a member of an ex-regular reserve force in connection with the person's liability, or potential liability, to be called out for service under Part 6; (b) to contact a person to whom section 66 applies in connection with the person's liability, or potential liability, to be recalled for service under Part 7. (3) Where a person's contact details are supplied under subsection (2) for a purpose described in that subsection, they may also be used for defence purposes connected with the person's service (whether past, present or future) in the reserve forces or regular services. (4) In this section, “HMRC” means Her Majesty's Revenue and Customs. (125B) (1) A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific). (2) A person who contravenes subsection (1) is guilty of an offence. (3) It is a defence for a person charged with an offence under this section to prove that the person reasonably believed— (a) that the disclosure was lawful, or (b) that the information had already lawfully been made available to the public. (4) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section. (5) Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section. (125C) (1) Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation. (2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Offences

Penalties for offences

196

(1) A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding level 5 on the standard scale.

(2) A person who commits an offence under section 132, 144, 148, 148C, 170, 171 or 184 is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;

(3) Subsections (4) and (5) apply where a person is convicted of an offence under section 170 or 184.

(4) The court by or before which the person is convicted may order a document or other material to be forfeited, destroyed or erased if—

(a) it has been used in connection with the processing of personal data, and

(b) it appears to the court to be connected with the commission of the offence,

subject to subsection (5).

(5) If a person, other than the offender, who claims to be the owner of the material, or to be otherwise interested in the material, applies to be heard by the court, the court must not make an order under subsection (4) without giving the person an opportunity to show why the order should not be made.

Prosecution

197

(1) In England and Wales, proceedings for an offence under this Act may be instituted only—

(a) by the Commissioner, or

(b) by or with the consent of the Director of Public Prosecutions.

(2) In Northern Ireland, proceedings for an offence under this Act may be instituted only—

(a) by the Commissioner, or

(b) by or with the consent of the Director of Public Prosecutions for Northern Ireland.

(3) Subject to subsection (4), summary proceedings for an offence under section 173 (alteration etc of personal data to prevent disclosure) may be brought within the period of 6 months beginning with the day on which the prosecutor first knew of evidence that, in the prosecutor's opinion, was sufficient to bring the proceedings.

(4) Such proceedings may not be brought after the end of the period of 3 years beginning with the day on which the offence was committed.

(5) A certificate signed by or on behalf of the prosecutor and stating the day on which the 6 month period described in subsection (3) began is conclusive evidence of that fact.

(6) A certificate purporting to be signed as described in subsection (5) is to be treated as so signed unless the contrary is proved.

(7) In relation to proceedings in Scotland, section 136(3) of the Criminal Procedure (Scotland) Act 1995 (deemed date of commencement of proceedings) applies for the purposes of this section as it applies for the purposes of that section.

Liability of directors etc

198

(1) Subsection (2) applies where—

(a) an offence under this Act has been committed by a body corporate, and

(b) it is proved to have been committed with the consent or connivance of or to be attributable to neglect on the part of—

(i) a director, manager, secretary or similar officer of the body corporate, or

(ii) a person who was purporting to act in such a capacity.

(2) The director, manager, secretary, officer or person, as well as the body corporate, is guilty of the offence and liable to be proceeded against and punished accordingly.

(3) Where the affairs of a body corporate are managed by its members, subsections (1) and (2) apply in relation to the acts and omissions of a member in connection with the member's management functions in relation to the body as if the member were a director of the body corporate.

(4) Subsection (5) applies where—

(a) an offence under this Act has been committed by a Scottish partnership, and

(b) the contravention in question is proved to have occurred with the consent or connivance of, or to be attributable to any neglect on the part of, a partner.

(5) The partner, as well as the partnership, is guilty of the offence and liable to be proceeded against and punished accordingly.

Recordable offences

199

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) Regulations under section 27(4) of the Police and Criminal Evidence Act 1984 (recordable offences) may repeal subsection (1).

Guidance about PACE codes of practice

200

(1) The Commissioner must produce and publish guidance about how the Commissioner proposes to perform the duty under section 67(9) of the Police and Criminal Evidence Act 1984 (duty to have regard to codes of practice under that Act when investigating offences and charging offenders) in connection with offences under this Act.

(2) The Commissioner—

(a) may alter or replace the guidance, and

(b) must publish any altered or replacement guidance.

(3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including any altered or replacement guidance).

(4) The Commissioner must arrange for guidance under this section (including any altered or replacement guidance) to be laid before Parliament.

The Tribunal

Disclosure of information to the Tribunal

201

(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of—

(a) its functions under the data protection legislation, or

(b) its other functions relating to the Commissioner's acts and omissions.

(2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.

Proceedings in the First-tier Tribunal: contempt

202

(1) This section applies where—

(a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal—

(i) on an appeal under section 27, 79, 82E, 111 or 162, or

(ii) for an order under section 166, and

(b) if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court.

(2) The First-tier Tribunal may certify the offence to the Upper Tribunal.

(3) Where an offence is certified under subsection (2), the Upper Tribunal may—

(a) inquire into the matter, and

(b) deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal.

(4) Before exercising the power under subsection (3)(b), the Upper Tribunal must—

(a) hear any witness who may be produced against or on behalf of the person charged with the offence, and

(b) hear any statement that may be offered in defence.

Tribunal Procedure Rules

203

(1) Tribunal Procedure Rules may make provision for regulating—

(a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and

(b) the exercise of the rights of data subjects under section 166, including their exercise by a representative body.

(2) In relation to proceedings involving the exercise of those rights, Tribunal Procedure Rules may make provision about—

(a) securing the production of material used for the processing of personal data, and

(b) the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data.

Interpretation

204

(1) In this Act, “health professional” means any of the following—

(a) a registered medical practitioner;

(b) a registered nurse or midwife;

(d) a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989 (see section 36 of that Act);

(e) a registered osteopath with the meaning of the Osteopaths Act 1993 (see section 41 of that Act);

(f) a registered chiropractor within the meaning of the Chiropractors Act 1994 (see section 43 of that Act);

(g) a person registered as a member of a profession to which the Health ... Professions Order 2001 (S.I. 2002/254) for the time being extends; ...

(h) a registered pharmacist or a registered pharmacy technician within the meaning of the Pharmacy Order 2010 (S.I. 2010/231) (see article 3 of that Order);

(i) a registered person within the meaning of the Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) (see Article 2 of that Order);

(j) a child psychotherapist;

(k) a scientist employed by a health service body as head of a department.

(l) a person registered under the Anaesthesia Associates and Physician Associates Order 2024.

(2) In this Act, “social work professional” means any of the following—

(a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;

(b) a person registered as a social worker in the register maintained by Social Care Wales under section 80 of the Regulation and Inspection of Social Care (Wales) Act 2016 (anaw 2);

(c) a person registered as a social worker in the register maintained by the Scottish Social Services Council under section 44 of the Regulation of Care (Scotland) Act 2001 (asp 8);

(d) a person registered as a social worker in the register maintained by the Northern Ireland Social Care Council under section 3 of the Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.)).

(3) In subsection (1)(a) “registered medical practitioner” includes a person who is provisionally registered under section 15 or 21 of the Medical Act 1983 and is engaged in such employment as is mentioned in subsection (3) of that section.

(4) In subsection (1)(k) “health service body” means any of the following—

(a) the Secretary of State in relation to the exercise of functions under section 2A or 2B of, or paragraph 7C, 8 or 12 of Schedule 1 to, the National Health Service Act 2006;

(b) a local authority in relation to the exercise of functions under section 2B or 111 of, or any of paragraphs 1 to 7B or 13 of Schedule 1 to, the National Health Service Act 2006;

(d) a Special Health Authority established under section 28 of the National Health Service Act 2006;

(e) an NHS foundation trust;

(f) the National Institute for Health and Care Excellence;

(g) NHS England;

(h) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;

(i) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;

(j) a National Health Service trust first established under section 18 of the National Health Service (Wales) Act 2006;

(k) a Special Health Authority established under section 22 of the National Health Service (Wales) Act 2006;

(l) a Health Board within the meaning of the National Health Service (Scotland) Act 1978;

(m) a Special Health Board within the meaning of the National Health Service (Scotland) Act 1978;

(n) a National Health Service trust first established under section 12A of the National Health Service (Scotland) Act 1978;

(o) the managers of a State Hospital provided under section 102 of the National Health Service (Scotland) Act 1978;

(p) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(q) a special health and social care agency established under the Health and Personal Social Services (Special Agencies) (Northern Ireland) Order 1990 (S.I. 1990/247 (N.I. 3));

(r) a Health and Social Care trust established under Article 10 of the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1)).

General interpretation

205

(1) In this Act—

“biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data;

“data concerning health” means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;

“enactment” includes—an enactment passed or made after this Act,an enactment comprised in subordinate legislation,an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...an enactment comprised in, or in an instrument made under, Northern Ireland legislation; andany assimilated direct legislation;

“genetic data” means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;

“government department” includes the following (except in the expression “United Kingdom government department”)—a part of the Scottish Administration;a Northern Ireland department;the Welsh Government;a body or authority exercising statutory functions on behalf of the Crown;

“health record” means a record which—consists of data concerning health, andhas been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates;

“inaccurate”, in relation to personal data, means incorrect or misleading as to any matter of fact;

“international obligation of the United Kingdom” includes—. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .an obligation that arises under an international agreement or arrangement to which the United Kingdom is a party;

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

“Minister of the Crown” has the same meaning as in the Ministers of the Crown Act 1975;

“publish” means make available to the public or a section of the public (and related expressions are to be read accordingly);

“subordinate legislation” has the meaning given in the Interpretation Act 1978;

“tribunal” means any tribunal in which legal proceedings may be brought;

“the Tribunal”, in relation to an application or appeal under this Act, means—the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, orthe First-tier Tribunal, in any other case.

(1A) In this Act, references to fundamental rights or fundamental freedoms (however expressed) are to the Convention rights within the meaning of the Human Rights Act 1998.

(2) References in this Act to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, except in—

(za) section 119A(10) and (11);

(a) section 125(4), (7) and (8);

(b) section 161(3), (5) and (6);

(d) section 178(2);

(e) section 182(8) ...;

(f) section 183(4);

(g) section 192(3), (5) and (6);

(h) section 197(3) and (4);

(i) paragraph 23(4) and (5) of Schedule 1;

(j) paragraphs 5(4) and 6(4) of Schedule 3;

(k) Schedule 5;

(l) paragraph 11(5) of Schedule 12;

(la) paragraph 22(6) of Schedule 12A;

(m) Schedule 15;

(and the references in section 5 to terms used in ... Part 2 do not include references to a period expressed in hours, days, weeks, months or years).

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) In the definition of “the UK GDPR” in section 3(10)—

(a) the reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“the 2019 Regulations”), but

(b) nothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified.

(5) Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other assimilated law are to be interpreted.

Index of defined expressions

206

The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of Part 2 of this Act.

Territorial application

Territorial application of this Act

207

(1) This Act applies only to processing of personal data described in subsections (1A) and (2).

(1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.

(2) In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) Subsections (1), (1A) and (2) have effect subject to any provision in or made under section 120 providing for the Commissioner to carry out functions in relation to other processing of personal data.

(5) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (2).

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this section, references to a person who has an establishment in the United Kingdom include the following—

(a) an individual who is ordinarily resident in the United Kingdom,

(b) a body incorporated under the law of the United Kingdom or a part of the United Kingdom,

(c) a partnership or other unincorporated association formed under the law of the United Kingdom or a part of the United Kingdom, and

(d) a person not within paragraph (a), (b) or (c) who maintains, and carries on activities through, an office, branch or agency or other stable arrangements in the United Kingdom,

....

General

Children in Scotland

208

(1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to—

(a) exercise a right conferred by the data protection legislation, or

(b) give consent for the purposes of the data protection legislation.

(2) The person is to be taken to have that capacity where the person has a general understanding of what it means to exercise the right or give such consent.

(3) A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding, unless the contrary is shown.

Application to the Crown

209

(1) This Act binds the Crown.

(2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).

(3) Where government departments are not able to enter into contracts with each other, a provision of the UK GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.

(4) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the UK GDPR and this Act is—

(a) in relation to the Royal Household, the Keeper of the Privy Purse,

(b) in relation to the Duchy of Lancaster, such person as the Chancellor of the Duchy appoints, and

(c) in relation to the Duchy of Cornwall, such person as the Duke of Cornwall, or the possessor for the time being of the Duchy of Cornwall, appoints.

(5) Different persons may be appointed under subsection (4)(b) or (c) for different purposes.

(6) As regards criminal liability—

(a) a government department is not liable to prosecution under this Act;

(b) nothing in subsection (4) makes a person who is a controller by virtue of that subsection liable to prosecution under this Act;

(c) a person in the service of the Crown is liable to prosecution under the provisions of this Act listed in subsection (7).

(7) Those provisions are—

(a) section 119;

(b) section 170;

(d) section 173;

(e) paragraph 15 of Schedule 15.

Application to Parliament

210

(1) Parts 1, 2 and 5 to 7 of this Act apply to the processing of personal data by or on behalf of either House of Parliament.

(2) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Commons, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.

(3) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Lords, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.

(4) Subsections (2) and (3) do not apply where the purposes for which and the manner in which the personal data is, or is to be, processed are determined by or on behalf of the Intelligence and Security Committee of Parliament.

(5) As regards criminal liability—

(a) nothing in subsection (2) or (3) makes the Corporate Officer of the House of Commons or the Corporate Officer of the House of Lords liable to prosecution under this Act;

(b) a person acting on behalf of either House of Parliament is liable to prosecution under the provisions of this Act listed in subsection (6).

(6) Those provisions are—

(a) section 170;

(b) section 171;

(d) paragraph 15 of Schedule 15.

Minor and consequential provision

211

(1) In Schedule 19—

(a) Part 1 contains minor and consequential amendments of primary legislation;

(b) Part 2 contains minor and consequential amendments of other legislation;

(d) Part 4 contains supplementary provision.

(2) The Secretary of State may by regulations make provision that is consequential on any provision made by this Act.

(3) Regulations under subsection (2)—

(a) may include transitional, transitory or saving provision;

(b) may amend, repeal or revoke an enactment.

(4) The reference to an enactment in subsection (3)(b) does not include an enactment passed or made after the end of the Session in which this Act is passed.

(5) Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.

(6) Any other regulations under this section are subject to the negative resolution procedure.

(7) In this section, “primary legislation” means—

(a) an Act;

(b) an Act of the Scottish Parliament;

(d) Northern Ireland legislation.

Final

Commencement

212

(1) Except as provided by subsections (2) and (3), this Act comes into force on such day as the Secretary of State may by regulations appoint.

(2) This section and the following provisions come into force on the day on which this Act is passed—

(a) sections 1 and 3;

(b) section 182;

(d) sections 209 and 210;

(e) sections 213(2), 214 and 215;

(f) any other provision of this Act so far as it confers power to make regulations or Tribunal Procedure Rules or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed.

(3) The following provisions come into force at the end of the period of 2 months beginning when this Act is passed—

(a) section 124;

(b) sections 125, 126 and 127, so far as they relate to a code prepared under section 124;

(d) section 178 and Schedule 17;

(e) section 179.

(4) Regulations under this section may make different provision for different areas.

Transitional provision

213

(1) Schedule 20 contains transitional, transitory and saving provision.

(2) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act or with the EU GDPR beginning to apply, including provision amending or repealing a provision of Schedule 20.

(3) Regulations under this section that amend or repeal a provision of Schedule 20 are subject to the negative resolution procedure.

(4) Schedule 21 contains further transitional, transitory and saving provision made in connection with the amendment of this Act and the UK GDPR by regulations under section 8 of the European Union (Withdrawal) Act 2018.

Extent

214

(1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to—

(a) subsections (2) to (5), and

(b) paragraph 12 of Schedule 12.

(2) Section 199 extends to England and Wales only.

(3) Sections 188, 189 and 190 extend to England and Wales and Northern Ireland only.

(4) An amendment, repeal or revocation made by this Act has the same extent in the United Kingdom as the enactment amended, repealed or revoked.

(5) This subsection and the following provisions also extend to the Isle of Man—

(a) paragraphs 332 and 434 of Schedule 19;

(b) sections 211(1), 212(1) and 213(2), so far as relating to those paragraphs.

(6) Where there is a power to extend a part of an Act by Order in Council to any of the Channel Islands, the Isle of Man or any of the British overseas territories, the power may be exercised in relation to an amendment or repeal of that part which is made by or under this Act.

Short title

215

This Act may be cited as the Data Protection Act 2018.

SCHEDULE 1

PART 1 — Conditions relating to employment, health and research etc

1

(1) This condition is met if—

(a) the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection, and

(b) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2) See also the additional safeguards in Part 4 of this Schedule.

(3) In this paragraph—

“social security” includes any of the branches of social security listed in Article 3(1) of Regulation (EC) No. 883/2004 of the European Parliament and of the Council on the co-ordination of social security systems (as amended from time to time);

“social protection” includes an intervention described in Article 2(b) of Regulation (EC) 458/2007 of the European Parliament and of the Council of 25 April 2007 on the European system of integrated social protection statistics (ESSPROS) as it had effect in EU law immediately before IP completion day.

2

(1) This condition is met if the processing is necessary for health or social care purposes.

(2) In this paragraph “health or social care purposes” means the purposes of—

(a) preventive or occupational medicine,

(b) the assessment of the working capacity of an employee,

(d) the provision of health care or treatment,

(e) the provision of social care, or

(f) the management of health care systems or services or social care systems or services.

(3) See also the conditions and safeguards in Article 9(3) of the UK GDPR (obligations of secrecy) and section 11(1).

Public health

3

This condition is met if the processing—

(a) is necessary for reasons of public interest in the area of public health, and

(b) is carried out—

(i) by or under the responsibility of a health professional, or

(ii) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

Research etc

4

This condition is met if the processing—

(a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,

(b) is carried out in accordance with Article 84B of the UK GDPR, and

PART 2 — Substantial public interest conditions

Requirement for an appropriate policy document when relying on conditions in this Part

5

(1) Except as otherwise provided, a condition in this Part of this Schedule is met only if, when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2) See also the additional safeguards in Part 4 of this Schedule.

Statutory etc and government purposes

6

(1) This condition is met if the processing—

(a) is necessary for a purpose listed in sub-paragraph (2), and

(b) is necessary for reasons of substantial public interest.

(2) Those purposes are—

(a) the exercise of a function conferred on a person by an enactment or rule of law;

(b) the exercise of a function of the Crown, a Minister of the Crown or a government department.

Administration of justice and parliamentary purposes

7

This condition is met if the processing is necessary—

(a) for the administration of justice, or

(b) for the exercise of a function of either House of Parliament.

Equality of opportunity or treatment

8

(1) This condition is met if the processing—

(a) is of a specified category of personal data, and

(b) is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained,

subject to the exceptions in sub-paragraphs (3) to (5).

(2) In sub-paragraph (1), “specified” means specified in the following table—

Category of personal data	Groups of people (in relation to a category of personal data)
Personal data revealing racial or ethnic origin	People of different racial or ethnic origins
Personal data revealing religious or philosophical beliefs	People holding different religious or philosophical beliefs
Data concerning health	People with different states of physical or mental health
Personal data concerning an individual's sexual orientation	People of different sexual orientation

(3) Processing does not meet the condition in sub-paragraph (1) if it is carried out for the purposes of measures or decisions with respect to a particular data subject.

(4) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.

(5) Processing does not meet the condition in sub-paragraph (1) if—

(a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement),

(b) the notice gave the controller a reasonable period in which to stop processing such data, and

Racial and ethnic diversity at senior levels of organisations

9

(1) This condition is met if the processing—

(a) is of personal data revealing racial or ethnic origin,

(b) is carried out as part of a process of identifying suitable individuals to hold senior positions in a particular organisation, a type of organisation or organisations generally,

(c) is necessary for the purposes of promoting or maintaining diversity in the racial and ethnic origins of individuals who hold senior positions in the organisation or organisations, and

(d) can reasonably be carried out without the consent of the data subject,

subject to the exception in sub-paragraph (3).

(2) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(3) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.

(4) For the purposes of this paragraph, an individual holds a senior position in an organisation if the individual—

(a) holds a position listed in sub-paragraph (5), or

(b) does not hold such a position but is a senior manager of the organisation.

(5) Those positions are—

(a) a director, secretary or other similar officer of a body corporate;

(b) a member of a limited liability partnership;

(c) a partner in a partnership within the Partnership Act 1890, a limited partnership registered under the Limited Partnerships Act 1907 or an entity of a similar character formed under the law of a country or territory outside the United Kingdom.

(6) In this paragraph, “senior manager”, in relation to an organisation, means a person who plays a significant role in—

(a) the making of decisions about how the whole or a substantial part of the organisation's activities are to be managed or organised, or

(b) the actual managing or organising of the whole or a substantial part of those activities.

(7) The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

Preventing or detecting unlawful acts

10

(1) This condition is met if the processing—

(a) is necessary for the purposes of the prevention , investigation or detection of an unlawful act,

(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and

(2) If the processing consists of the disclosure of personal data to a competent authority, or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

(3) In this paragraph—

“act” includes a failure to act;

“competent authority” has the same meaning as in Part 3 of this Act (see section 30).

Protecting the public against dishonesty etc

11

(1) This condition is met if the processing—

(a) is necessary for the exercise of a protective function,

(b) must be carried out without the consent of the data subject so as not to prejudice the exercise of that function, and

(2) In this paragraph, “protective function” means a function which is intended to protect members of the public against—

(a) dishonesty, malpractice or other seriously improper conduct,

(b) unfitness or incompetence,

(d) failures in services provided by a body or association.

Regulatory requirements relating to unlawful acts and dishonesty etc

12

(1) This condition is met if—

(a) the processing is necessary for the purposes of complying with, or assisting other persons to comply with, a regulatory requirement which involves a person taking steps to establish whether another person has—

(i) committed an unlawful act, or

(ii) been involved in dishonesty, malpractice or other seriously improper conduct,

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing, and

(2) In this paragraph—

“act” includes a failure to act;

“regulatory requirement” means—a requirement imposed by legislation or by a person in exercise of a function conferred by legislation, ora requirement forming part of generally accepted principles of good practice relating to a type of body or an activity.

Journalism etc in connection with unlawful acts and dishonesty etc

13

(1) This condition is met if—

(a) the processing consists of , or is carried out in preparation for, the disclosure of personal data for the special purposes,

(b) it is carried out in connection with a matter described in sub-paragraph (2),

(d) it is carried out with a view to the publication of the personal data by any person, and

(e) the controller reasonably believes that publication of the personal data would be in the public interest.

(2) The matters mentioned in sub-paragraph (1)(b) are any of the following (whether alleged or established)—

(a) the commission of an unlawful act by a person;

(b) dishonesty, malpractice or other seriously improper conduct of a person;

(d) mismanagement in the administration of a body or association;

(e) a failure in services provided by a body or association.

(3) The condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

(4) In this paragraph—

“act” includes a failure to act;

“the special purposes” means—the purposes of journalism;academic purposes;artistic purposes;literary purposes.

Preventing fraud

14

(1) This condition is met if the processing—

(a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and

(b) consists of—

(i) the disclosure of personal data by a person as a member of an anti-fraud organisation,

(ii) the disclosure of personal data in accordance with arrangements made by an anti-fraud organisation,

(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or

(iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).

(2) In this paragraph, “anti-fraud organisation” has the same meaning as in section 68 of the Serious Crime Act 2007.

Suspicion of terrorist financing or money laundering

15

This condition is met if the processing is necessary for the purposes of making a disclosure in good faith under either of the following—

(a) section 21CA of the Terrorism Act 2000 (disclosures between certain entities within regulated sector in relation to suspicion of commission of terrorist financing offence or for purposes of identifying terrorist property);

(b) section 339ZB of the Proceeds of Crime Act 2002 (disclosures within regulated sector in relation to suspicion of money laundering).

Support for individuals with a particular disability or medical condition

16

(1) This condition is met if the processing—

(a) is carried out by a not-for-profit body which provides support to individuals with a particular disability or medical condition,

(b) is of a type of personal data falling within sub-paragraph (2) which relates to an individual falling within sub-paragraph (3),

(i) raising awareness of the disability or medical condition, or

(ii) providing support to individuals falling within sub-paragraph (3) or enabling such individuals to provide support to each other,

(d) can reasonably be carried out without the consent of the data subject, and

(e) is necessary for reasons of substantial public interest.

(2) The following types of personal data fall within this sub-paragraph—

(a) personal data revealing racial or ethnic origin;

(b) genetic data or biometric data;

(d) personal data concerning an individual's sex life or sexual orientation.

(3) An individual falls within this sub-paragraph if the individual is or has been a member of the body mentioned in sub-paragraph (1)(a) and—

(a) has the disability or condition mentioned there, has had that disability or condition or has a significant risk of developing that disability or condition, or

(b) is a relative or carer of an individual who satisfies paragraph (a) of this sub-paragraph.

(4) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(5) In this paragraph—

“carer” means an individual who provides or intends to provide care for another individual other than—under or by virtue of a contract, oras voluntary work;

“disability” has the same meaning as in the Equality Act 2010 (see section 6 of, and Schedule 1 to, that Act).

(6) The reference in sub-paragraph (4)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

Counselling etc

17

(1) This condition is met if the processing—

(a) is necessary for the provision of confidential counselling, advice or support or of another similar service provided confidentially,

(b) is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(2) The reasons mentioned in sub-paragraph (1)(b) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the service mentioned in sub-paragraph (1)(a).

Safeguarding of children and of individuals at risk

18

(1) This condition is met if—

(a) the processing is necessary for the purposes of—

(i) protecting an individual from neglect or physical, mental or emotional harm, or

(ii) protecting the physical, mental or emotional well-being of an individual,

(b) the individual is—

(i) aged under 18, or

(ii) aged 18 or over and at risk,

(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(d) the processing is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(a) has needs for care and support,

(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.

Safeguarding of economic well-being of certain individuals

19

(1) This condition is met if the processing—

(a) is necessary for the purposes of protecting the economic well-being of an individual at economic risk who is aged 18 or over,

(b) is of data concerning health,

(d) is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) In this paragraph, “individual at economic risk” means an individual who is less able to protect his or her economic well-being by reason of physical or mental injury, illness or disability.

Insurance

20

(1) This condition is met if the processing—

(a) is necessary for an insurance purpose,

(b) is of personal data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, genetic data or data concerning health, and

subject to sub-paragraphs (2) and (3).

(2) Sub-paragraph (3) applies where—

(a) the processing is not carried out for the purposes of measures or decisions with respect to the data subject, and

(b) the data subject does not have and is not expected to acquire—

(i) rights against, or obligations in relation to, a person who is an insured person under an insurance contract to which the insurance purpose mentioned in sub-paragraph (1)(a) relates, or

(ii) other rights or obligations in connection with such a contract.

(3) Where this sub-paragraph applies, the processing does not meet the condition in sub-paragraph (1) unless, in addition to meeting the requirements in that sub-paragraph, it can reasonably be carried out without the consent of the data subject.

(4) For the purposes of sub-paragraph (3), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(5) In this paragraph—

“insurance contract” means a contract of general insurance or long-term insurance;

“insurance purpose” means—advising on, arranging, underwriting or administering an insurance contract,administering a claim under an insurance contract, orexercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.

(6) The reference in sub-paragraph (4)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

(7) Terms used in the definition of “insurance contract” in sub-paragraph (5) and also in an order made under section 22 of the Financial Services and Markets Act 2000 (regulated activities) have the same meaning in that definition as they have in that order.

Occupational pensions

21

(1) This condition is met if the processing—

(a) is necessary for the purpose of making a determination in connection with eligibility for, or benefits payable under, an occupational pension scheme,

(b) is of data concerning health which relates to a data subject who is the parent, grandparent, great-grandparent or sibling of a member of the scheme,

(d) can reasonably be carried out without the consent of the data subject.

(2) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(3) In this paragraph—

“occupational pension scheme” has the meaning given in section 1 of the Pension Schemes Act 1993;

“member”, in relation to a scheme, includes an individual who is seeking to become a member of the scheme.

(4) The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

Political parties

22

(1) This condition is met if the processing—

(a) is of personal data revealing political opinions,

(b) is carried out by a person or organisation included in the register maintained under section 23 of the Political Parties, Elections and Referendums Act 2000, and

subject to the exceptions in sub-paragraphs (2) and (3).

(2) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to a person.

(3) Processing does not meet the condition in sub-paragraph (1) if—

(a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement),

(b) the notice gave the controller a reasonable period in which to stop processing such data, and

(4) In this paragraph, “political activities” include campaigning, fund-raising, political surveys and case-work.

Elected representatives responding to requests

23

(1) This condition is met if—

(a) the processing is carried out—

(i) by an elected representative or a person acting with the authority of such a representative,

(ii) in connection with the discharge of the elected representative's functions, and

(iii) in response to a request by an individual that the elected representative take action on behalf of the individual, and

(b) the processing is necessary for the purposes of, or in connection with, the action reasonably taken by the elected representative in response to that request,

subject to sub-paragraph (2).

(2) Where the request is made by an individual other than the data subject, the condition in sub-paragraph (1) is met only if the processing must be carried out without the consent of the data subject for one of the following reasons—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the elected representative cannot reasonably be expected to obtain the consent of the data subject to the processing;

(d) the processing is necessary in the interests of another individual and the data subject has withheld consent unreasonably.

(3) In this paragraph, “elected representative” means—

(a) a member of the House of Commons;

(b) a member of the National Assembly for Wales;

(d) a member of the Northern Ireland Assembly;

(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(f) an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 1972, namely—

(i) in England, a county council, a district council, a London borough council or a parish council;

(ii) in Wales, a county council, a county borough council or a community council;

(g) an elected mayor of a local authority within the meaning of Part 1A or 2 of the Local Government Act 2000;

(h) a mayor for the area of a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009;

(ha) a mayor for the area of a combined county authority established under section 9(1) of the Levelling-up and Regeneration Act 2023;

(i) the Mayor of London or an elected member of the London Assembly;

(j) an elected member of—

(i) the Common Council of the City of London, or

(ii) the Council of the Isles of Scilly;

(k) an elected member of a council constituted under section 2 of the Local Government etc (Scotland) Act 1994;

(l) an elected member of a district council within the meaning of the Local Government Act (Northern Ireland) 1972 (c. 9 (N.I.));

(m) a police and crime commissioner.

(4) For the purposes of sub-paragraph (3), a person who is—

(a) a member of the House of Commons immediately before Parliament is dissolved,

(b) a member of the National Assembly for Wales immediately before that Assembly is dissolved,

(d) a member of the Northern Ireland Assembly immediately before that Assembly is dissolved,

is to be treated as if the person were such a member until the end of the period of 30 days beginning with the day after the day on which the subsequent general election in relation to that Parliament or Assembly is held.

(5) For the purposes of sub-paragraph (3), a person who is an elected member of the Common Council of the City of London and whose term of office comes to an end at the end of the day preceding the annual Wardmotes is to be treated as if he or she were such a member until the end of the fourth day after the day on which those Wardmotes are held.

Disclosure to elected representatives

24

(1) This condition is met if—

(a) the processing consists of , or is carried out in preparation for, the disclosure of personal data—

(i) to an elected representative or a person acting with the authority of such a representative, and

(ii) in response to a communication to the controller from that representative or person which was made in response to a request from an individual,

(b) the personal data is relevant to the subject matter of that communication, and

subject to sub-paragraph (2).

(2) Where the request to the elected representative came from an individual other than the data subject, the condition in sub-paragraph (1) is met only if the disclosure must be made without the consent of the data subject for one of the following reasons—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the elected representative cannot reasonably be expected to obtain the consent of the data subject to the processing;

(d) the processing is necessary in the interests of another individual and the data subject has withheld consent unreasonably.

(3) In this paragraph, “elected representative” has the same meaning as in paragraph 23.

Informing elected representatives about prisoners

25

(1) This condition is met if—

(a) the processing consists of the processing of personal data about a prisoner for the purpose of informing a member of the House of Commons, a member of the National Assembly for Wales or a member of the Scottish Parliament about the prisoner, and

(b) the member is under an obligation not to further disclose the personal data.

(2) The references in sub-paragraph (1) to personal data about, and to informing someone about, a prisoner include personal data about, and informing someone about, arrangements for the prisoner's release.

(3) In this paragraph—

“prison” includes a young offender institution, a remand centre, a secure training centre or a secure college;

“prisoner” means a person detained in a prison.

Publication of legal judgments

26

This condition is met if the processing—

(a) consists of the publication of a judgment or other decision of a court or tribunal, or

(b) is necessary for the purposes of publishing such a judgment or decision.

Anti-doping in sport

27

(1) This condition is met if the processing is necessary—

(a) for the purposes of measures designed to eliminate doping which are undertaken by or under the responsibility of a body or association that is responsible for eliminating doping in a sport, at a sporting event or in sport generally, or

(b) for the purposes of providing information about doping, or suspected doping, to such a body or association.

(2) The reference in sub-paragraph (1)(a) to measures designed to eliminate doping includes measures designed to identify or prevent doping.

(3) If the processing consists of the disclosure of personal data to a body or association described in sub-paragraph (1)(a), or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

Standards of behaviour in sport

28

(1) This condition is met if the processing—

(a) is necessary for the purposes of measures designed to protect the integrity of a sport or a sporting event,

(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and

(2) In sub-paragraph (1)(a), the reference to measures designed to protect the integrity of a sport or a sporting event is a reference to measures designed to protect a sport or a sporting event against—

(a) dishonesty, malpractice or other seriously improper conduct, or

(b) failure by a person participating in the sport or event in any capacity to comply with standards of behaviour set by a body or association with responsibility for the sport or event.

PART 3 — Additional conditions relating to criminal convictions etc

29

This condition is met if the data subject has given consent to the processing.

Protecting individual’s vital interests

30

This condition is met if—

(a) the processing is necessary to protect the vital interests of an individual, and

(b) the data subject is physically or legally incapable of giving consent.

Processing by not-for-profit bodies

31

This condition is met if the processing is carried out—

(a) in the course of its legitimate activities with appropriate safeguards by a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, and

(b) on condition that—

(i) the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes, and

(ii) the personal data is not disclosed outside that body without the consent of the data subjects.

Personal data in the public domain

32

This condition is met if the processing relates to personal data which is manifestly made public by the data subject.

Legal claims

33

This condition is met if the processing—

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

Judicial acts

34

This condition is met if the processing is necessary when a court or tribunal is acting in its judicial capacity.

Administration of accounts used in commission of indecency offences involving children

35

(1) This condition is met if—

(a) the processing is of personal data about a conviction or caution for an offence listed in sub-paragraph (2),

(b) the processing is necessary for the purpose of administering an account relating to the payment card used in the commission of the offence or cancelling that payment card, and

(c) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2) Those offences are an offence under—

(a) section 1 of the Protection of Children Act 1978 (indecent photographs of children),

(b) Article 3 of the Protection of Children (Northern Ireland) Order 1978 (S.I. 1978/1047 (N.I. 17)) (indecent photographs of children),

(d) section 160 of the Criminal Justice Act 1988 (possession of indecent photograph of child),

(e) Article 15 of the Criminal Justice (Evidence etc) (Northern Ireland) Order 1988 (S.I. 1988/1847 (N.I. 17)) (possession of indecent photograph of child), or

(f) section 62 of the Coroners and Justice Act 2009 (possession of prohibited images of children),

or incitement to commit an offence under any of those provisions.

(3) See also the additional safeguards in Part 4 of this Schedule.

(4) In this paragraph—

“caution” means a caution given to a person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted;

“conviction” has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (S.I. 1978/1908 (N.I. 27));

“payment card” includes a credit card, a charge card and a debit card.

Extension of conditions in Part 2 of this Schedule referring to substantial public interest

36

This condition is met if the processing would meet a condition in Part 2 of this Schedule but for an express requirement for the processing to be necessary for reasons of substantial public interest.

Extension of insurance conditions

37

This condition is met if the processing—

(a) would meet the condition in paragraph 20 in Part 2 of this Schedule (the “insurance condition”), or

(b) would meet the condition in paragraph 36 by virtue of the insurance condition,

but for the requirement for the processing to be processing of a category of personal data specified in paragraph 20(1)(b).

PART 4 — Appropriate policy document and additional safeguards

Application of this Part of this Schedule

38

This Part of this Schedule makes provision about the processing of personal data carried out in reliance on a condition in Part 1, 2 or 3 of this Schedule which requires the controller to have an appropriate policy document in place when the processing is carried out.

Requirement to have an appropriate policy document in place

39

The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which—

(a) explains the controller's procedures for securing compliance with the principles in Article 5 of the UK GDPR (principles relating to processing of personal data) in connection with the processing of personal data in reliance on the condition in question, and

(b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained.

Additional safeguard: retention of appropriate policy document

40

(1) Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period—

(a) retain the appropriate policy document,

(b) review and (if appropriate) update it from time to time, and

(2) “Relevant period”, in relation to the processing of personal data in reliance on a condition described in paragraph 38, means a period which—

(a) begins when the controller starts to carry out processing of personal data in reliance on that condition, and

(b) ends at the end of the period of 6 months beginning when the controller ceases to carry out such processing.

Additional safeguard: record of processing

41

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.

Data Protection Act 2018

Publication and review of the Framework

193

Effect of the Framework

194

Data-sharing: HMRC and reserve forces

Reserve forces: data-sharing by HMRC

195

Offences

Penalties for offences

196

Prosecution

197

Liability of directors etc

198

Recordable offences

199

Guidance about PACE codes of practice

200

The Tribunal

Disclosure of information to the Tribunal

201

Proceedings in the First-tier Tribunal: contempt

202

Tribunal Procedure Rules

203

Interpretation

Meaning of “health professional” and “social work professional”

204

General interpretation

205

Index of defined expressions

206

Territorial application

Territorial application of this Act

207

General

Children in Scotland

208

Application to the Crown

209

Application to Parliament

210

Minor and consequential provision

211

Final

Commencement

212

Transitional provision

213

Extent

214

Short title

215

SCHEDULE 1

PART 1 — Conditions relating to employment, health and research etc

Employment, social security and social protection

1

Health or social care purposes

2

Public health

3

Research etc

4

PART 2 — Substantial public interest conditions

Requirement for an appropriate policy document when relying on conditions in this Part

5

Statutory etc and government purposes

6

Administration of justice and parliamentary purposes

7

Equality of opportunity or treatment

8

Racial and ethnic diversity at senior levels of organisations

9

Preventing or detecting unlawful acts

10

Protecting the public against dishonesty etc

11

Regulatory requirements relating to unlawful acts and dishonesty etc