Data Protection Act 2018 (c. 12) – Section 78A – National security exemption
Sections
Section 78A[F1National security exemption
(1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.
(2) The provisions are—
- (a)Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);
- (b)Chapter 3 of this Part (rights of the data subject);
- (c)in Chapter 4 of this Part—
- (i)section 67 (notification of personal data breach to the [F2Commission]);
- (ii)section 68 (communication of personal data breach to the data subject);
- (i)
- (d)Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);
- (e)in Part 5—
- (i)section 119 (inspection in accordance with international obligations);
- (ia)[F3 section 119A (standard clauses for transfers to third countries);]
- (ii)in Schedule 13 (other general functions of the [F4Commission]), paragraphs 1(1)(a) and (g) and 2;
- (i)
- (f)in Part 6—
- (i)sections 142 to 154 and Schedule 15 ( [F5Commission's] notices and powers of entry and inspection);
- (ii)sections 170 to 173 (offences relating to personal data);
- (i)
- (g)in Part 7, section 187 (representation of data subjects).
(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
- (a)section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
- (b)section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
- (c)section 42 (safeguards: sensitive processing);
- (d)Schedule 8 (conditions for sensitive processing).
(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
- (a)the following provisions of section 73—
- (i)subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
- (ii)subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
- (i)
- (b)section 78 (subsequent transfers).]
Amended text
This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 S. 78A inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(7), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
- F2 Word in s. 78A(2)(c)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F3 S. 78A(2)(e)(ia) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 19 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
- F4 Word in s. 78A(2)(e)(ii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F5 Word in s. 78A(2)(f)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
https://dpa2018.digiphile.law/article/article-78A.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.