{
  "url": "https://openlegislation.uk/data-protection-act-2018/section-26",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/section-26.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "section/26",
  "kind": "section",
  "number": "26",
  "heading": "National security and defence exemption",
  "text": "(1) A provision of the UK GDPR or this Act mentioned in subsection (2) does not apply to personal data to which the UK GDPR applies if exemption from the provision is required for—\n(a) the purpose of safeguarding national security, or\n(b) defence purposes.\n(2) The provisions are—\n(a) Chapter II of the UK GDPR (principles) except for—\n(i) Article 5(1)(a) (lawful, fair and transparent processing), so far as it requires processing of personal data to be lawful;\n(ii) Article 6 (lawfulness of processing);\n(iii) Article 9 (processing of special categories of personal data);\n(b) Chapter III of the UK GDPR (rights of data subjects);\n(c) in Chapter IV of the UK GDPR—\n(i) Article 33 (notification of personal data breach to the Commission);\n(ii) Article 34 (communication of personal data breach to the data subject);\n(d) Chapter V of the UK GDPR (transfers of personal data to third countries or international organisations);\n(e) in Chapter VI of the UK GDPR—\n(i) Article 57(1)(a) and (h) ( Commission's duties to monitor and enforce the UK GDPR and to conduct investigations);\n(ii) Article 58 (investigative, corrective, authorisation and advisory powers of Commission);\n(f) Chapter VIII of the UK GDPR (remedies, liabilities and penalties) except for—\n(ai) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n(i) Article 83 (general conditions for imposing administrative fines);\n(ii) Article 84 (penalties);\n(fa) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .\n(g) in Part 5 of this Act—\n(i) in section 115 (general functions of the Commission), subsections (3) and (8);\n(ii) in section 115, subsection (9), so far as it relates to Article 58(2)(i) of the UK GDPR;\n(iii) section 119 (inspection in accordance with international obligations);\n(iv) section 119A (standard clauses for transfers to third countries);\n(h) in Part 6 of this Act—\n(i) sections 142 to 154 and Schedule 15 ( Commission notices and powers of entry and inspection);\n(ii) sections 170 to 173 (offences relating to personal data);\n(i) in Part 7 of this Act, section 187 (representation of data subjects).",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Words in s. 26(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Words in s. 26(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F3",
      "text": "Words in s. 26(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F4",
      "text": "Words in s. 26(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F5",
      "text": "Words in s. 26(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F6",
      "text": "Word in s. 26(2)(c)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F7",
      "text": "Words in s. 26(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F8",
      "text": "Words in s. 26(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F9",
      "text": "Word in s. 26(2)(e)(i)(ii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F10",
      "text": "Words in s. 26(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F11",
      "text": "S. 26(2)(f)(ai) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 9; S.I. 2026/82, reg. 3(b) (with reg. 7)"
    },
    {
      "type": "F",
      "label": "F12",
      "text": "S. 26(2)(fa) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 17 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)"
    },
    {
      "type": "F",
      "label": "F13",
      "text": "Word in s. 26(2)(g)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F14",
      "text": "Words in s. 26(2)(g)(ii) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(e)(i) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F15",
      "text": "S. 26(2)(g)(iv) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(e)(ii) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F16",
      "text": "Word in s. 26(2)(h)(i) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "C",
      "label": "C1",
      "text": "Pt. 2 Ch. 3 applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481), regs. 1, 27(3) (with reg. 46))"
    },
    {
      "type": "I",
      "label": "I1",
      "text": "S. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/section/26",
    "retrieved_at": "2026-10-29T09:04:55.804064+00:00",
    "licence": "OGL-UK-3.0",
    "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
    "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
  }
}