{
  "url": "https://openlegislation.uk/draft-data-protection-act-2018-qualifying-competent-authorities-regulations-2025/note",
  "json_url": "https://openlegislation.uk/draft-data-protection-act-2018-qualifying-competent-authorities-regulations-2025/note.json",
  "legislation": "ukdsi/2025/9780348273632",
  "legislation_title": "The Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025",
  "legislation_url": "https://openlegislation.uk/draft-data-protection-act-2018-qualifying-competent-authorities-regulations-2025",
  "path": "note",
  "kind": "note",
  "number": null,
  "heading": "Explanatory note",
  "text": "(This note is not part of the Regulations)\nSections 89 and 90 of the Data (Use and Access) Act (c. 18) (“the DUAA”) amend the Data Protection Act 2018 (c. 12) (“the DPA”) to enable joint processing between qualifying competent authorities and intelligence services, under Part 4 of the DPA. This enables the controllers, previously unable to process jointly, to process personal data within a single, common regime. The controls and safeguards under Part 4 of the DPA will apply to all such joint processing. Section 89(2) of the DUAA amends section 82 of the DPA, widening the scope of Part 4 of the DPA. Previously, Part 4 of the DPA only applied to processing by or on behalf of the intelligence services. As amended, section 82 also applies Part 4 of the DPA to the processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice. Section 89(2) of the DUAA inserts new subsection (2A) into section 82 of the DPA, which grants a power to the Secretary of State to make regulations to specify and describe which competent authorities (as defined in section 30 of the DPA) are “qualifying competent authorities”, and so able to apply for or be issued with a designation notice.\nThese Regulations specify and describe which competent authorities are “qualifying competent authorities” for the purposes of the DPA. The qualifying competent authorities will be able to apply jointly with the intelligence services for a designation notice under section 82A of the DPA. The Secretary of State may give a notice designating processing of personal data by a qualifying competent authority where this is required for the purposes of safeguarding national security, and subject to compliance with application requirements in the DPA. Before making these Regulations, the Secretary of State consulted the Commissioner and such other persons as the Secretary of State considers appropriate.\nA full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukdsi/2025/9780348273632/note",
    "retrieved_at": "2026-10-30T14:38:51.406207+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}