EdLaw
General processing: supplements to the UK GDPR
Part 2 provisions that supplement the UK GDPR for general processing: public-interest lawfulness, child's consent in relation to information society services, the special-categories and criminal-convictions regime (with Schedule 1 conditions), safeguards for automated decision-making authorised by law, and the exemptions gateway (Schedules 2–4).
Section 8 — Lawfulness of processing: public interest etc
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of ... official authority includes processing of personal data that is necessary for—
- a the administration of justice,
- b the exercise of a function of either House of Parliament,
- c the exercise of a function conferred on a person by an enactment or rule of law,
- d the exercise of a function of the Crown, a Minister of the Crown or a government department, or
- e an activity that supports or promotes democratic engagement.
Section 9 — Child's consent in relation to information society services
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 10 — Special categories of personal data and criminal convictions etc data
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
1 Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
- a point (b) (employment, social security and social protection);
- b point (g) (substantial public interest);
- c point (h) (health and social care);
- d point (i) (public health);
- e point (j) (archiving, research and statistics).
2 The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
3 The processing meets the requirement in point (g) of Article 9(2) of the UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
4 Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
5 The processing meets the requirement in Article 10(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
Section 11 — Special categories of personal data etc: supplementary
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
1 For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the UK GDPR (obligation of secrecy) include circumstances in which it is carried out—
- a by or under the responsibility of a health professional or a social work professional, or
- b by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
2 In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—
- a the alleged commission of offences by the data subject, or
- b proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.
Section 14 — Automated decision-making authorised by law: safeguards
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 15 — Exemptions etc
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
1 Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR.
- a Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 6(3) and Article 23(1) of the UK GDPR);
- b Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 23(1) of the UK GDPR);
- c Part 3 makes provision restricting the application of Article 15 of the UK GDPR where this is necessary to protect the rights of others (of a kind described in Article 23(1) of the UK GDPR);
- d Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the UK GDPR in specified circumstances (of a kind described in Article 23(1) of the UK GDPR);
- e Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV and V of the UK GDPR for reasons relating to freedom of expression (of a kind described in Article 85(2) of the UK GDPR);
- f Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the UK GDPR for scientific or historical research purposes, statistical purposes and archiving purposes ....
3 Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to health, social work, education and child abuse data (of a kind described in Article 23(1) of the UK GDPR).
4 Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to information the disclosure of which is prohibited or restricted by an enactment (of a kind described in Article 23(1) of the UK GDPR).
4A In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).
5 In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part (sections 26 to 28).
Sources
- legislation.gov.uk — Data Protection Act 2018, consolidated text
- ICO — Data Protection Act 2018 guidance
Meta
All section text above is reproduced verbatim from the consolidated Data Protection Act 2018 on legislation.gov.uk, extracted mechanically from the official XML. Repealed or omitted text appears as "..." exactly as published. Amendment history is available via each section link. Each provision carries its official identifier as a trailing attribute anchor (e.g. {#section-9-1}), the same id legislation.gov.uk uses.