Legal Update - 17 November 2025
Sections 89 and 90 of the Data (Use and Access) Act 2025 amend the Data Protection Act 2018 (DPA) from 17 November 2025, to enable joint processing between ‘qualifying competent authorities’ and intelligence services, under Part 4 of the DPA. This enables the controllers, previously unable to process jointly, to process personal data within a single, common regime. The controls and safeguards under Part 4 of the DPA will apply to all such joint processing.
Qualifying competent authorities will be able to apply jointly with the intelligence services for a designation notice under section 82A of the DPA. The Secretary of State may give a notice designating the processing of personal data by a qualifying competent authority, where this is required for the purposes of safeguarding national security, and subject to compliance with application requirements in the DPA.
The Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025 is also in force from 17 November 2025. Regulation 2 specifies which competent authorities are ‘qualifying competent authorities’ for the purposes of the DPA.
For quick and easy access in the future, click the pin icon from the top right of any document to save it to 'My Documents'.
