Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 82A – Designation of processing by a qualifying competent authority

Sections

Section 82A[F1Designation of processing by a qualifying competent authority

(1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—
  • (a)
    an application for designation of the processing is made in accordance with this section, and
  • (b)
    the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.
(2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.
(3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—
  • (a)
    a country or territory outside the United Kingdom, or
  • (b)
    an international organisation.
(4) A designation notice must—
  • (a)
    specify or describe the processing and qualifying competent authority that are designated, and
  • (b)
    be given to the applicants for the designation (and see also section 82D).
(5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—
  • (a)
    the qualifying competent authority, and
  • (b)
    the intelligence service with which the processing is to be carried out.
(6) An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.
(7) The application must—
  • (a)
    describe the processing, including the intended purposes and means of processing, and
  • (b)
    explain why the applicants consider that designation is required for the purposes of safeguarding national security.
(8) Before giving a designation notice, the Secretary of State must consult the [F2Commission].
(9) In this section, “joint controller”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.]

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Ss. 82A-82E inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(3), 142(1); S.I. 2025/996, reg. 2(2)(a)
  2. F2 Word in s. 82A(8) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

https://dpa2018.digiphile.law/article/article-82A.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.