Regulation 46 Confidentiality of processing

A person who has access to personal data in connection with activities referred to in regulation 29 may process that data only if that person is a member of, or acts on instructions of, a UK competent authority, unless he is required to do so by an enactment or rule of law.

A person working for a UK competent authority may only process such personal data in accordance with this Part.