Data Protection Act 2018 (c. 12) – Section 82 – Processing to which this Part applies

Sections

Section 82Processing to which this Part applies

(A1) [^F1 This Part—

(a)
applies to processing of personal data by an intelligence service, and
(b)
applies to processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice that is for the time being in force (see sections 82A to 82E).]

(1) This Part applies [^F2only] to—

(a)
[^F3processing] of personal data wholly or partly by automated means, and
(b)
[^F4processing] otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.

(2) In this Part, “intelligence service” means—

(a)
the Security Service;
(b)
the Secret Intelligence Service;
(c)
the Government Communications Headquarters.

(2A) [^F5 In this Part—

“competent authority” has the same meaning as in Part 3;
“qualifying competent authority” means a competent authority specified or described in regulations made by the Secretary of State.]

(3) A reference in this Part to the processing of personal data is to processing to which this Part applies.

(4) [^F6 Regulations under this section are subject to the affirmative resolution procedure.]

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 S. 82(A1) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(a), 142(1); S.I. 2025/996, reg. 2(2)(a)
F2 Word in s. 82(1) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(b)(i), 142(1); S.I. 2025/996, reg. 2(2)(a)
F3 Word in s. 82(1)(a) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(b)(ii), 142(1); S.I. 2025/996, reg. 2(2)(a)
F4 Word in s. 82(1)(b) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(b)(iii), 142(1); S.I. 2025/996, reg. 2(2)(a)
F5 S. 82(2A) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(c), 142(1)(2)(h); S.I. 2025/996, reg. 2(2)(a)
F6 S. 82(4) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(d), 142(1)(2)(h); S.I. 2025/996, reg. 2(2)(a)

Commencement Information

I1 S. 82 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

https://dpa2018.digiphile.law/article/article-82.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.