Data Protection Act 2018 (c. 12) – Section 87 – The second data protection principle

Sections

Section 87The second data protection principle

(1) The second data protection principle is that—

(a)
the purpose for which personal data is collected [^F1(whether from the data subject or otherwise)] must be specified, explicit and legitimate, and
(b)
personal data so collected must not be processed [^F2by or on behalf of a controller] in a manner that is incompatible with the purpose for which [^F3the controller collected it].

(2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3) Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—

(a)
the controller is authorised by law to process the data for that purpose, and
(b)
the processing is necessary and proportionate to that other purpose.

(4) Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—

(a)
consists of—
- (i)
  processing for archiving purposes in the public interest,
- (ii)
  processing for the purposes of scientific or historical research, or
- (iii)
  processing for statistical purposes, and
(b)
is subject to appropriate safeguards for the rights and freedoms of the data subject.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Words in s. 87(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(9)(a), 142(1); S.I. 2026/82, reg. 2(d)
F2 Words in s. 87(1)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(9)(b)(i), 142(1); S.I. 2026/82, reg. 2(d)
F3 Words in s. 87(1)(b) substituted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 71(9)(b)(ii), 142(1); S.I. 2026/82, reg. 2(d)

Commencement Information

I1 S. 87 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

https://dpa2018.digiphile.law/article/article-87.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.