Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 10 – Special categories of personal data and criminal convictions etc data

Sections

Section 10Special categories of personal data and criminal convictions etc data

(1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the [F1UK GDPR] (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
  • (a)
    point (b) (employment, social security and social protection);
  • (b)
    point (g) (substantial public interest);
  • (c)
    point (h) (health and social care);
  • (d)
    point (i) (public health);
  • (e)
    point (j) (archiving, research and statistics).
(2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the [F2UK GDPR] for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
(3) The processing meets the requirement in point (g) of Article 9(2) of the [F3UK GDPR] for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
(4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
(5) The processing meets the requirement in Article [F410(1) of the UK GDPR] for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
(6) The Secretary of State may by regulations—
  • (a)
    amend Schedule 1—
    • (i)
      by adding or varying conditions or safeguards, and
    • (ii)
      by omitting conditions or safeguards added by regulations under this section, and
  • (b)
    consequentially amend this section.
(7) Regulations under this section are subject to the affirmative resolution procedure.

Annotations

Textual Amendments

  1. F1 Words in s. 10(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 Words in s. 10(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F3 Words in s. 10(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Words in s. 10(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

  1. I1 S. 10 in force at Royal Assent for specified purposes, see s. 212(2)(f)
  2. I2 S. 10 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)

https://dpa2018.digiphile.law/article/article-10.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.