Data Protection Act 2018, section 42

Safeguards: sensitive processing

PART 3 Law enforcement processing

(1)This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).

(2)The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—

(a)explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and

(b)explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.

(3)Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period—

(a)retain the appropriate policy document,

(b)review and (if appropriate) update it from time to time, and

(c)make it available to the [F181CommissionF181] , on request, without charge.

(4)The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information—

(a)whether the sensitive processing is carried out in reliance on the consent of the data subject or, if not, which condition in Schedule 8 is relied on,

(b)how the processing satisfies section 35 (lawfulness of processing), and

(c)whether the personal data is retained and erased in accordance with the policies described in subsection (2)(b) and, if it is not, the reasons for not following those policies.

(5) In this section, “relevant period”, in relation to sensitive processing in reliance on the consent of the data subject or in reliance on a condition specified in Schedule 8, means a period which—

(a)begins when the controller starts to carry out the sensitive processing in reliance on the data subject's consent or (as the case may be) in reliance on that condition, and

(b)ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.

Definitions used in section 42 4

controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act
sensitive processing

(8) In this Part , “sensitive processing” means—

(a)the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

(b)the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;

(c)the processing of data concerning health;

(d)the processing of data concerning an individual's sex life or sexual orientation.

Defined in s.35(8) · see it in the full Act

(6A) “Sensitive processing” has the meaning given in section 35(8).

Defined in s.33(6A) · see it in the full Act
the relevant period

(3) In this paragraph, “the relevant period”, in relation to a code issued under a section mentioned in sub-paragraph (1), means the period—

(a) beginning when the amendments of that section in Schedule 19 to this Act come into force, and

(b) ending when the code is first reissued under that section.

Defined in Sch.20 para.48(3) · see it in the full Act
processor

(3) In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

Defined in s.32(3) · see it in the full Act

Cases considering section 42 5

M, R (On the Application Of) v The Chief Constable of Sussex Police

[2021] EWCA Civ 42 · 19 January 2021Interprets

Applied as the statutory framework for an appropriate policy document accompanying sensitive processing. (see paras [13], [49], [99]-[106]) Held that the document must explain compliance procedures and retention and erasure policies, but need not be separate for sensitive data or refer expressly to Article 9. (see paras [49], [99]-[106]) Required retention, review and availability of the appropriate policy document during and after sensitive processing. (see para [52]) Required recording of the consent or Schedule 8 condition relied on and how the processing satisfies section 35. (see para [52])

Bridges, R (On the Application Of) v South Wales Police

[2020] EWCA Civ 1058 · 11 August 2020

Rejects the challenge to the Divisional Court’s decision to leave policy document compliance unresolved. The challenged deployments preceded commencement, the document was evolving, the Information Commissioner considered it sufficient, and later guidance prompted revision (see paras [159]–[162]). Makes no final determination whether the November 2018 policy document met the prescribed standard. In light of the Information Commissioner’s view and forthcoming guidance, the Divisional Court appropriately left the document for reconsideration and revision (see paras [160]–[161]). Confirms that the appropriate policy document must be kept under review and updated from time to time. Its evolving character supported leaving compliance unresolved pending regulatory guidance in the circumstances (see paras [160]–[161]).

Bridges, R (On Application of) v The Chief Constable of South Wales Police

[2019] EWHC 2341 (Admin) · 4 September 2019Interprets

Interprets the appropriate-policy-document requirement. The police document explained some compliance policies but was brief and potentially incomplete, especially regarding members of the public; the court left final compliance open. (see paras [138]-[141])

What each judgment says about section 42 is in the case-law panel in the full Act.

Amendments and notes

2 notes from legislation.gov.uk

Amendments

  1. F181Word in s. 42(3)(c) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement

  1. I42S. 42 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)