The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
Section 37: The third data protection principle
Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk
Part 3: Law enforcement processing — CHAPTER 2: Principles
About this text
This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.
Reuse reviewed 21 August 2026 under Open Government Licence v3.0.