# Data Protection Act 2018, Paragraph 8


(1) The processing is necessary for medical purposes and is undertaken by—
(a) a health professional, or
(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.
(2) In this paragraph, “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

---
Source: https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/8 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018/schedule-10/paragraph-8
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.