Data Protection Act 2018, section 35

The first data protection principle

PART 3 Law enforcement processing

(1)The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.

(2)The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—

(a)the data subject has given consent to the processing for that purpose, or

(b)the processing is necessary for the performance of a task carried out for that purpose by a competent authority.

(3)In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).

(4)The first case is where—

(a)the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and

(b)at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(5)The second case is where—

(a)the processing is strictly necessary for the law enforcement purpose,

(b)the processing meets at least one of the conditions in Schedule 8, and

(c)at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(6)The Secretary of State may by regulations amend Schedule 8—

(a)by adding conditions;

(b)by [F175varying orF175] omitting conditions added by regulations under paragraph (a).

(7)Regulations under subsection (6) are subject to the affirmative resolution procedure.

(8) In this [F176 Part F176] , “sensitive processing” means—

(a)the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

(b)the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;

(c)the processing of data concerning health;

(d)the processing of data concerning an individual's sex life or sexual orientation.

Definitions used in section 35 8

the law enforcement purposes

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Defined in s.31 · see it in the full Act
competent authority

(1) In this Part, “competent authority” means—

(a)a person specified or described in Schedule 7, and

(b)any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

Defined in s.30(1) · see it in the full Act
Sensitive processing

(6A) “Sensitive processing” has the meaning given in section 35(8).

Defined in s.33(6A) · see it in the full Act
controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act
the affirmative resolution procedure

(7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

Defined in s.182(7) · see it in the full Act
genetic data

“genetic data” means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;

Defined in s.205(1) · see it in the full Act
biometric data

“biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data;

Defined in s.205(1) · see it in the full Act
data concerning health

“data concerning health” means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;

Defined in s.205(1) · see it in the full Act

Cases considering section 35 18

YZ v The Chief Constable of South Wales Police

[2022] EWCA Civ 683 · 19 May 2022Interprets

Section 35 requires law-enforcement processing to be lawful and fair and, for sensitive personal data, strictly necessary for specified purposes. Retention must also be proportionate, and strict necessity is for the court to determine for itself on judicial review. (see paras [26]–[29], [72]–[78]) Section 35(1) forms part of the requirement that law-enforcement processing be lawful and fair. The court treats compliant retention as requiring more than rationality: it must satisfy the statutory lawfulness, fairness, necessity and proportionality requirements. (see paras [26]–[29], [56], [72]–[78]) Section 35(2) is part of the statutory scheme governing sensitive personal data and the need for an appropriate policy framework. The court holds that the applicable police-records policies met the relevant requirements. (see paras [56], [71]–[73]) Section 35(2)(b) is treated as requiring strict necessity for processing sensitive personal data for a specified law-enforcement purpose. The court finds that the retained information met that standard when assessed against the overall safeguarding and public-safety risks. (see paras [56], [72]–[78]) Section 35(5) is cited in connection with the appropriate-policy-document requirement. The court holds that the relevant policing policies addressed retention, erasure, risk, proportionality and review sufficiently to meet that requirement. (see paras [71]–[73]) Section 35(5)(c) is cited as part of the appropriate-policy-document framework. The court holds that the MoPI APP, read with the Guidance where appropriate, satisfied the relevant policy requirement. (see paras [56], [71]–[73]) Section 35(8) supplies the statutory concept of sensitive personal data, including data concerning religious or political beliefs, racial or ethnic origin and health. The judgment uses that classification in applying the heightened strict-necessity requirements. (see para [27])

M v Regina

[2021] EWCA Crim 1934 · 17 December 2021Defines

The court applied section 35 to the processing of sensitive personal data. Examination of the mobile telephone was based on law, served a law-enforcement purpose and satisfied the relevant statutory conditions; procedural shortcomings did not materially affect the section 78 assessment. (see paras [21]; [24]-[28]; [41]-[42]) The court treated data concerning sexual orientation as sensitive processing within the Part 3 framework. That classification informed the assessment of the statutory conditions governing police review of the mobile-phone data. (see para [23])

M, R (On the Application Of) v The Chief Constable of Sussex Police

[2021] EWCA Civ 42 · 19 January 2021Interprets

Applied the first data protection principle and the additional requirements governing sensitive processing. (see paras [37], [47], [59], [70]) Required law-enforcement processing to be based on law and consent or necessity for a task carried out by a competent authority. (see paras [47], [68], [107]) Required sensitive processing to satisfy one of the two statutory cases in section 35(4) or section 35(5). (see para [47]) Applied the strict-necessity, Schedule 8 and appropriate-policy-document requirements to the proposed disclosure of a photographic image. (see paras [47], [87], [107]) Defined sensitive processing by listing data concerning specified categories, including health, sex life and sexual orientation. The only relevant data potentially within the definition here was a biometric photograph. (see paras [37], [51], [94])

What each judgment says about section 35 is in the case-law panel in the full Act.

Amendments and notes

4 notes from legislation.gov.uk

Amendments

  1. F175Words in s. 35(6)(b) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(4)(a), 142(1); S.I. 2025/904, reg. 2(c)
  2. F176Word in s. 35(8) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(4)(b), 142(1); S.I. 2025/904, reg. 2(c)

Commencement

  1. I34S. 35 in force at Royal Assent for specified purposes, see s. 212(2)(f) text for certain specified purposes only, see the commentary.
  2. I35S. 35 in force in so far as not already in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)