Data Protection Act 2018 (c. 12) – Section 35 – The first data protection principle

Sections

Section 35The first data protection principle

(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.

(2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—

(a)
the data subject has given consent to the processing for that purpose, or
(b)
the processing is necessary for the performance of a task carried out for that purpose by a competent authority.

(3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).

(4) The first case is where—

(a)
the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and
(b)
at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(5) The second case is where—

(a)
the processing is strictly necessary for the law enforcement purpose,
(b)
the processing meets at least one of the conditions in Schedule 8, and
(c)
at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(6) The Secretary of State may by regulations amend Schedule 8—

(a)
by adding conditions;
(b)
by [^F1varying or] omitting conditions added by regulations under paragraph (a).

(7) Regulations under subsection (6) are subject to the affirmative resolution procedure.

(8) In this [^F2Part], “sensitive processing” means—

(a)
the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
(b)
the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;
(c)
the processing of data concerning health;
(d)
the processing of data concerning an individual's sex life or sexual orientation.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Words in s. 35(6)(b) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(4)(a), 142(1); S.I. 2025/904, reg. 2(c)
F2 Word in s. 35(8) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(4)(b), 142(1); S.I. 2025/904, reg. 2(c)

Commencement Information

I1 S. 35 in force at Royal Assent for specified purposes, see s. 212(2)(f)
I2 S. 35 in force in so far as not already in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-35.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.