{
  "url": "https://openlegislation.uk/eu-regulation-2016-679/article-10",
  "json_url": "https://openlegislation.uk/eu-regulation-2016-679/article-10.json",
  "legislation": "eur/2016/679",
  "legislation_title": "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2016-679",
  "path": "article/10",
  "kind": "article",
  "number": "10",
  "heading": "Processing of personal data relating to criminal convictions and offences",
  "text": "(1.) Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law , or relevant international law, providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.\n(2.) In the 2018 Act—\n(za) section 9A makes provision about when the requirement in paragraph 1 of this Article for authorisation by relevant international law is met;\n(a) section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met;\n(b) section 11(2) makes provision about the meaning of “personal data relating to criminal convictions and offences or related security measures”.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Art. 10 renumbered as Art 10(1) (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 10(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Words in Art. 10(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 10(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F3",
      "text": "Words in Art. 10(1) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 72(5)(a), 142(1); S.I. 2025/904, reg. 2(b)"
    },
    {
      "type": "F",
      "label": "F4",
      "text": "Art. 10(2) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 10(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F5",
      "text": "Art. 10(2)(za) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 72(5)(b), 142(1); S.I. 2025/904, reg. 2(b)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/10",
    "retrieved_at": "2026-11-01T14:45:51.683617+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}