Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 26 – National security and defence exemption

Sections

Section 26National security and defence exemption

(1) A provision of [F1the UK GDPR] or this Act mentioned in subsection (2) does not apply to personal data to which [F2the UK GDPR] applies if exemption from the provision is required for—
  • (a)
    the purpose of safeguarding national security, or
  • (b)
    defence purposes.
(2) The provisions are—
  • (a)
    Chapter II of [F3the UK GDPR] (principles) except for—
    • (i)
      Article 5(1)(a) (lawful, fair and transparent processing), so far as it requires processing of personal data to be lawful;
    • (ii)
      Article 6 (lawfulness of processing);
    • (iii)
      Article 9 (processing of special categories of personal data);
  • (b)
    Chapter III of [F4the UK GDPR] (rights of data subjects);
  • (c)
    in Chapter IV of [F5the UK GDPR]—
    • (i)
      Article 33 (notification of personal data breach to the [F6Commission]);
    • (ii)
      Article 34 (communication of personal data breach to the data subject);
  • (d)
    Chapter V of [F7the UK GDPR] (transfers of personal data to third countries or international organisations);
  • (e)
    in Chapter VI of [F8the UK GDPR]—
    • (i)
      Article 57(1)(a) and (h) ( [F9Commission's] duties to monitor and enforce [F8the UK GDPR] and to conduct investigations);
    • (ii)
      Article 58 (investigative, corrective, authorisation and advisory powers of [F9Commission]);
  • (f)
    Chapter VIII of [F10the UK GDPR] (remedies, liabilities and penalties) except for—
    • (ai)
      F11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
    • (i)
      Article 83 (general conditions for imposing administrative fines);
    • (ii)
      Article 84 (penalties);
  • (fa)
    F12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
  • (g)
    in Part 5 of this Act—
    • (i)
      in section 115 (general functions of the [F13Commission]), subsections (3) and (8);
    • (ii)
      in section 115, subsection (9), so far as it relates to Article 58(2)(i) of [F14the UK GDPR];
    • (iii)
      section 119 (inspection in accordance with international obligations);
    • (iv)
      [F15 section 119A (standard clauses for transfers to third countries);]
  • (h)
    in Part 6 of this Act—
  • (i)
    in Part 7 of this Act, section 187 (representation of data subjects).

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Conditional amendment with no effect

legislation.gov.uk still lists the following conditional amendment(s) to this Section as not yet made. They have no effect, so the text above is not affected:

  • s. 26(2)(f)(ai): word substituted by S.I. 2026/386, Sch. 2, para. 23(2), (3) (NB: conditional amendment: if 2025 c 18, s. 103 is fully brought into force before s. 119 is fully brought into force, this amendment has no effect); commencement: reg. 1(2)

Note: This amendment has no effect: under reg. 1(4) of S.I. 2026/386 it falls away because section 103 of the Data (Use and Access) Act 2025 was fully brought into force (19 June 2026, S.I. 2026/82, reg. 3(a)) before section 119 (30 September 2026, S.I. 2026/1015, reg. 2).

Annotations

Textual Amendments

  1. F1 Words in s. 26(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 Words in s. 26(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F3 Words in s. 26(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Words in s. 26(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F5 Words in s. 26(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Word in s. 26(2)(c)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  7. F7 Words in s. 26(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Words in s. 26(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  9. F9 Word in s. 26(2)(e)(i)(ii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  10. F10 Words in s. 26(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  11. F11 S. 26(2)(f)(ai) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 9; S.I. 2026/82, reg. 3(b) (with reg. 7)
  12. F12 S. 26(2)(fa) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 17 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  13. F13 Word in s. 26(2)(g)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  14. F14 Words in s. 26(2)(g)(ii) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(e)(i) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  15. F15 S. 26(2)(g)(iv) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(e)(ii) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  16. F16 Word in s. 26(2)(h)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Modifications etc. (not altering text)

  1. C1 Pt. 2 Ch. 3 applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481), regs. 1, 27(3) (with reg. 46))

Commencement Information

  1. I1 S. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

https://dpa2018.digiphile.law/article/article-26.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.