OpenLegislation

The Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025

Draft. This instrument was laid in draft and may differ from the one made. Look for the made version under its title.

Draft 2025, ISBN 9780348273632

Original text. legislation.gov.uk does not revise statutory instruments, so later amendments are not shown here. Changes made to it are listed under each provision when known.

Draft Regulations laid before Parliament under sections 82(4) and 182(7) of the Data Protection Act 2018, for approval by resolution of each House of Parliament.

DATA PROTECTION

Made

Coming into force in accordance with regulation 1(2)

The Secretary of State makes these Regulations in exercise of the powers conferred by section 82(2A) of the Data Protection Act 2018f1.

In accordance with section 182(2) of that Act, the Secretary of State has consulted the Commissionerf2 and such other persons as the Secretary of State considers appropriate.

In accordance with sections 82(4) and 182(7) of that Actf3, a draft of the Regulations has been laid before Parliament and approved by a resolution of each House of Parliament.

Annotations to the whole text

Footnotes

f1

2018 c. 12; subsection (2A) was inserted by the Data (Use and Access) Act 2025 (c. 18), section 89(2).

f2

“The Commissioner” is defined in section 3 of the Data Protection Act 2018.

f3

Subsection (4) was inserted by the Data (Use and Access) Act 2025, section 89(2)(d).

Contents

  1. 1Citation, commencement and extent
  2. 2Qualifying competent authorities
  3. Signature
  4. Explanatory note

1Citation, commencement and extent

(1)

These Regulations may be cited as the Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025.

(2)

These Regulations come into force on the twenty-first day after the day on which they are made.

(3)

These Regulations extend to England and Wales, Scotland and Northern Ireland.

2Qualifying competent authorities

The following competent authorities are qualifying competent authoritiesf1 for the purposes of the Data Protection Act 2018—

(a)

any United Kingdom government department other than a non-ministerial government department;

(b)

the chief constable of a police force maintained under section 2 of the Police Act 1996f2;

(c)

the Commissioner of Police of the Metropolis;

(d)

the Commissioner of Police for the City of London;

(e)

the Chief Constable of the Police Service of Northern Ireland;

(f)

the chief constable of the Police Service of Scotland;

(g)

the chief constable of the British Transport Police;

(h)

the chief constable of the Civil Nuclear Constabulary;

(i)

the chief constable of the Ministry of Defence Police;

(j)

the Provost Marshal of the Royal Navy Police;

(k)

the Provost Marshal of the Royal Military Police;

(l)

the Provost Marshal of the Royal Air Force Police;

(m)

the Provost Marshal for serious crime;

(n)

the chief officer of—

(i)

a body of constables appointed under provision incorporating section 79 of the Harbours, Docks and Piers Clauses Act 1847f3;

(ii)

a body of constables appointed under an order made under section 14 of the Harbours Act 1964f4;

(iii)

the body of constables appointed under section 154 of the Port of London Act 1968f5;

(o)

a body established in accordance with a collaboration agreement under section 22A of the Police Act 1996f6;

(p)

the Commissioners for His Majesty’s Revenue and Customs;

(q)

the Director General of the National Crime Agency;

(r)

His Majesty’s Land Registry;

(s)

the Parole Board for England and Wales;

(t)

the Parole Board for Scotland;

(u)

the Parole Commissioners for Northern Ireland;

(v)

the Probation Board for Northern Ireland;

(w)

a person who is, under or by virtue of any enactment, responsible for securing the electronic monitoring of an individual.

Signature

Name

Secretary of State

Home Office

Date

Explanatory note

(This note is not part of the Regulations)

Sections 89 and 90 of the Data (Use and Access) Act (c. 18) (“the DUAA”) amend the Data Protection Act 2018 (c. 12) (“the DPA”) to enable joint processing between qualifying competent authorities and intelligence services, under Part 4 of the DPA. This enables the controllers, previously unable to process jointly, to process personal data within a single, common regime. The controls and safeguards under Part 4 of the DPA will apply to all such joint processing. Section 89(2) of the DUAA amends section 82 of the DPA, widening the scope of Part 4 of the DPA. Previously, Part 4 of the DPA only applied to processing by or on behalf of the intelligence services. As amended, section 82 also applies Part 4 of the DPA to the processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice. Section 89(2) of the DUAA inserts new subsection (2A) into section 82 of the DPA, which grants a power to the Secretary of State to make regulations to specify and describe which competent authorities (as defined in section 30 of the DPA) are “qualifying competent authorities”, and so able to apply for or be issued with a designation notice.

These Regulations specify and describe which competent authorities are “qualifying competent authorities” for the purposes of the DPA. The qualifying competent authorities will be able to apply jointly with the intelligence services for a designation notice under section 82A of the DPA. The Secretary of State may give a notice designating processing of personal data by a qualifying competent authority where this is required for the purposes of safeguarding national security, and subject to compliance with application requirements in the DPA. Before making these Regulations, the Secretary of State consulted the Commissioner and such other persons as the Secretary of State considers appropriate.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.