DPA 2018 Part 3: Law enforcement processing
Part 3 of the DPA (Data Protection Act) 2018 applies to competent authorities’ processing of personal data for law enforcement purposes.
This is permitted as long as it occurs:
- Wholly or partly by automated means; and
- Not by automated means where it forms, or is intended to form, part of a filing system.
Note that Part 3 applies only to processing for law enforcement purposes
This is defined as: “the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”.
Other processing by competent authorities will fall under the scope of the UK GDPR (General Data Protection Regulation). On some occasions, processing will fall under both regimes.
The DUAA (Data (Use and Access) Act 2025) came into law on 19 June 2025. We are currently reviewing and updating our information pages to account for the changes to UK data protection law introduced by the Act. If you need any expert guidance on how your data processing obligations will change.
