Remedy
Start free

Section 82A: Designation of processing by a qualifying competent authority

Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk

Part 4: Intelligence services processing — CHAPTER 1: Scope and definitions

For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a "designation notice") where—

an application for designation of the processing is made in accordance with this section, and
the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.

The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.

The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—

a country or territory outside the United Kingdom, or
an international organisation.

A designation notice must—

specify or describe the processing and qualifying competent authority that are designated, and
be given to the applicants for the designation (and see also section 82D).

An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—

the qualifying competent authority, and
the intelligence service with which the processing is to be carried out.

An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.

The application must—

describe the processing, including the intended purposes and means of processing, and
explain why the applicants consider that designation is required for the purposes of safeguarding national security.

Before giving a designation notice, the Secretary of State must consult the Commissioner.

In this section, "joint controller", in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.

About this text

This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.

Reuse reviewed 21 August 2026 under Open Government Licence v3.0.