DPA 2018 Part 4: Intelligence services processing
Part 4 of the DPA (Data Protection Act) 2018 applies to the UK intelligence services’ processing of personal data where it occurs:
- Wholly or partly by automated means; and
- Not by automated means where it forms, or is intended to form, part of a filing system.
The intelligence services are the Security Service (MI5), the Secret Intelligence Service (MI6) and the GCHQ (Government Communications Headquarters).
The DUAA (Data (Use and Access) Act 2025) came into law on 19 June 2025. We are currently reviewing and updating our information pages to account for the changes to UK data protection law introduced by the Act. If you need any expert guidance on how your data processing obligations will change.