Data Protection Act 2018, section 10

Special categories of personal data and criminal convictions etc data

PART 2 General processing

(1)Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the [F52UK GDPRF52] (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—

(a)point (b) (employment, social security and social protection);

(b)point (g) (substantial public interest);

(c)point (h) (health and social care);

(d)point (i) (public health);

(e)point (j) (archiving, research and statistics).

(2)The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the [F53UK GDPRF53] for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.

(3)The processing meets the requirement in point (g) of Article 9(2) of the [F54UK GDPRF54] for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.

(4)Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5)The processing meets the requirement in Article [F5510(1) of the UK GDPRF55] for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.

(6)The Secretary of State may by regulations—

(a)amend Schedule 1—

(i)by adding or varying conditions or safeguards, and

(ii)by omitting conditions or safeguards added by regulations under this section, and

(b)consequentially amend this section.

(7)Regulations under this section are subject to the affirmative resolution procedure.

Definitions used in section 10 1

the affirmative resolution procedure

(7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

Defined in s.182(7) · see it in the full Act

Cases considering section 10 11

United Grand Lodge of England R (on the application of) & Ors v The Commissioner of Police of the Metropolis

[2026] EWHC 330 (Admin) · 17 February 2026

The provision was identified as a legal basis for processing special-category data where necessary for employment-related legal obligations or rights. The relevant policy documents supplied sufficient clarity. (see para [50]) The provision was identified as supporting processing of special-category data for substantial public interest reasons. The relevant policy documents supplied sufficient clarity. (see para [50])

Joseph Pacini & Anor v Dow Jones & Company Incorporated

[2024] EWHC 1709 (KB) · 3 July 2024Interprets

The court identified the statutory consequence of Article 10 classification: processing criminal-offence data would be lawful only if one or more conditions in Schedule 1 Parts 1, 2 or 3 were met. The issue was suitable for preliminary determination (see para [121]).

YSL v Surrey and Borders Partnership NHS Foundation Trust

[2024] EWHC 391 (KB) · 22 February 2024

Processing relying on the health and public-health exceptions under article 9 required satisfaction of a Schedule 1 condition (see paras [155]-[158]).

What each judgment says about section 10 is in the case-law panel in the full Act.

Amendments and notes

6 notes from legislation.gov.uk

Amendments

  1. F52Words in s. 10(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F53Words in s. 10(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F54Words in s. 10(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F55Words in s. 10(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I10S. 10 in force at Royal Assent for specified purposes, see s. 212(2)(f) text for certain specified purposes only, see the commentary.
  2. I11S. 10 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)