Data Protection Act 2018, section 36

The second data protection principle

PART 3 Law enforcement processing

(1)The second data protection principle is that—

(a)the law enforcement purpose for which personal data is collected [F177(whether from the data subject or otherwise)F177] must be specified, explicit and legitimate, and

(b)personal data so collected must not be processed [F178by or on behalf of a controllerF178] in a manner that is incompatible with the purpose for which [F179the controller collected itF179] .

(2)Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3)Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—

(a)the controller is authorised by law to process the data for the other purpose, and

(b)the processing is necessary and proportionate to that other purpose.

(4)Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.

Definitions used in section 36 2

the law enforcement purposes

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Defined in s.31 · see it in the full Act
controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act

Cases considering section 36 6

M v Regina

[2021] EWCA Crim 1934 · 17 December 2021Interprets

The court applied the second data protection principle to the mobile-phone review. Processing legitimately undertaken for a specific law-enforcement purpose did not breach the principle merely because it revealed other material relevant to the overall law-enforcement purpose. (see paras [22]; [41])

Geoffrey Driver v Crown Prosecution Service

[2022] EWHC 2500 (KB) · 10 October 2022

Section 36(3)(b) was applied to require processing for another law-enforcement purpose to be necessary and proportionate. The disclosure was neither necessary nor proportionate. (see para [121])

Elgizouli, R. (On Application of) v The Secretary of State for the Home Department

[2020] EWHC 2516 (Admin) · 22 September 2020Limits

Requires the law-enforcement purpose for which personal data is collected to be specified, explicit and legitimate. The court used this requirement to emphasise that the statutory assessment concerns the particular purpose identified by the controller (see paras [33], [56]). Requires processing to be compatible with the purpose for which personal data was collected. The court treated compatibility as part of the statutory framework governing the proposed transfer (see paras [33], [56]). Permits processing for another law-enforcement purpose where the controller is authorised by law and the processing is necessary and proportionate to that purpose. The court confirmed that the assessment remains directed to the particular purpose in question (see paras [33], [56]). Requires legal authorisation for processing personal data for another law-enforcement purpose. The court referred to this statutory condition in explaining the structure of the data-protection regime (see para [33]). Requires processing for another law-enforcement purpose to be necessary and proportionate to that purpose. The court used the provision to reinforce its task-specific approach to necessity and proportionality (see paras [33], [56]). Restricts processing for a non-law-enforcement purpose unless authorised by law. The court set out the provision as part of the statutory framework, but the present transfer was for a law-enforcement purpose (see para [33]).

What each judgment says about section 36 is in the case-law panel in the full Act.

Amendments and notes

4 notes from legislation.gov.uk

Amendments

  1. F177Words in s. 36(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(a), 142(1); S.I. 2026/82, reg. 2(d)
  2. F178Words in s. 36(1)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(b)(i), 142(1); S.I. 2026/82, reg. 2(d)
  3. F179Words in s. 36(1)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(b)(ii), 142(1); S.I. 2026/82, reg. 2(d)

Commencement

  1. I36S. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)