- Section 34Overview and general duty of controller
(1) This Chapter sets out the six data protection principles as follows— (a) section 35(1) sets out the first data protection principle (requirement that processing be lawful and…
- Section 35The first data protection principle
(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. (2) The processing…
- Section 36The second data protection principle
(1) The second data protection principle is that— (a) the law enforcement purpose for which personal data is collected (whether from the data subject or otherwise) must be…
- Section 37The third data protection principle
The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the…
- Section 38The fourth data protection principle
(1) The fourth data protection principle is that— (a) personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to…
- Section 39The fifth data protection principle
(1) The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for…
- Section 40The sixth data protection principle
The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security…
- Section 41Safeguards: archiving
(1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out— (a) for archiving purposes in…
- Section 42Safeguards: sensitive processing
(1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive…
- Section 42AFurther provision about sensitive processing
(1) The Secretary of State may by regulations— (a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of…
https://dpa2018.digiphile.law/part/part-3-chapter-2.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.