United Kingdom: Lawful Processing & Special Data

Processing under Art. 6(1) UK GDPR requires one of the traditional six lawful bases or — from 5 February 2026 under DUAA 2025 s.70 (commenced by SI 2026/82) — the new Art. 6(1)(ea) 'recognised legitimate interests' basis for specified public-interest disclosures and safeguarding/crime-prevention conditions in Annex 1 UK GDPR, which eliminates the three-step balancing test where an Annex 1 condition is met while preserving the Art. 21 right to object. For standard Art. 6(1)(f) legitimate interests, DUAA 2025 inserts illustrative commercial activities (direct marketing, intra-group administrative transfers, network and information security) that still require a Legitimate Interests Assessment (LIA). Under s.67 and s.68 DUAA 2025 (in force 5 February 2026), scientific research is defined broadly on the face of the UK GDPR to include commercial and privately funded research, broad consent for scientific research is codified where specific sub-purposes cannot be fully identified at collection, and compatible further processing rules under Art. 5(1)(b) are clarified. Special category data under Art. 9 UK GDPR requires both an Art. 6 basis and an Art. 9(2) condition supplemented by Schedule 1 DPA 2018 (substantial public interest conditions in Part 2 of Schedule 1 generally require an Appropriate Policy Document under Part 4). Criminal convictions and offences data under Art. 10 UK GDPR and s.10(5) DPA 2018 must satisfy a Schedule 1 condition.