- Section 85Overview
(1) This Chapter sets out the six data protection principles as follows— (a) section 86 sets out the first data protection principle (requirement that processing be lawful, fair…
- Section 86The first data protection principle
(1) The first data protection principle is that the processing of personal data must be— (a) lawful, and (b) fair and transparent. (2) The processing of personal data…
- Section 87The second data protection principle
(1) The second data protection principle is that— (a) the purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit…
- Section 88The third data protection principle
The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
- Section 89The fourth data protection principle
The fourth data protection principle is that personal data undergoing processing must be accurate and, where necessary, kept up to date.
- Section 90The fifth data protection principle
The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed.
- Section 91The sixth data protection principle
(1) The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks that arise from…
- Section 91AFurther provision about sensitive processing
(1) The Secretary of State may by regulations— (a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of…
https://dpa2018.digiphile.law/part/part-4-chapter-2.html
Text as at 18 September 2026.
This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.