---
title: "United Kingdom — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-kingdom/lawful-processing-and-special-data/
source_html: /jurisdictions/united-kingdom/lawful-processing-and-special-data/index.html
description: "United Kingdom — Lawful Processing & Special Data (Amber, 4 sub-modules, 4 claims): Substantive alignment with EU GDPR continues, but amber reflects the newly-introduced recognised legitimate interest basis and consequential ICO guidance st"
generated_at: 2026-10-25T04:46:50Z
content_sha256: a18980365c91ae9cf59944168e7245c60cf513b84346bffd069cb8a63a4aedc3
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules4 claimsAmber▾#

Substantive alignment with EU GDPR continues, but amber reflects the newly-introduced recognised legitimate interest basis and consequential ICO guidance still being finalised post-DUAA.

Primary framework UK GDPR Articles 6-11; DPA 2018 Schedule 1; DUAA 2025 Schedule 4

Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/)

Traffic-light rationale — Amber Substantive alignment with EU GDPR continues, but amber reflects the newly-introduced recognised legitimate interest basis and consequential ICO guidance still being finalised post-DUAA.

#### Sub-modules (4)

Category narrative 219 words

Processing under Art. 6(1) UK GDPR requires one of the traditional six lawful bases or — from 5 February 2026 under DUAA 2025 s.70 (commenced by SI 2026/82) — the new Art. 6(1)(ea) 'recognised legitimate interests' basis for specified public-interest disclosures and safeguarding/crime-prevention conditions in Annex 1 UK GDPR, which eliminates the three-step balancing test where an Annex 1 condition is met while preserving the Art. 21 right to object. For standard Art. 6(1)(f) legitimate interests, DUAA 2025 inserts illustrative commercial activities (direct marketing, intra-group administrative transfers, network and information security) that still require a Legitimate Interests Assessment (LIA). Under s.67 and s.68 DUAA 2025 (in force 5 February 2026), scientific research is defined broadly on the face of the UK GDPR to include commercial and privately funded research, broad consent for scientific research is codified where specific sub-purposes cannot be fully identified at collection, and compatible further processing rules under Art. 5(1)(b) are clarified. Special category data under Art. 9 UK GDPR requires both an Art. 6 basis and an Art. 9(2) condition supplemented by Schedule 1 DPA 2018 (substantial public interest conditions in Part 2 of Schedule 1 generally require an Appropriate Policy Document under Part 4). Criminal convictions and offences data under Art. 10 UK GDPR and s.10(5) DPA 2018 must satisfy a Schedule 1 condition.

Evidence 4

Sources and claims (4)
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/08/ico-launches-consultations-for-data-use-and-access-act-2025-amendments/) — The DUAA 2025 introduces 'recognised legitimate interest' as a new UK GDPR lawful basis, separate from ordinary legitimate interests, limited to an exhaustive list of public-interest purposes such as crime prevention, safeguarding and emergencies.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/08/ico-launches-consultations-for-data-use-and-access-act-2025-amendments/) — Recognised legitimate interest cannot be relied upon by public authorities performing their public tasks, which must continue to use the public task lawful basis.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/code-standards/) — Where an online service relies on consent as its lawful basis, UK data protection law requires parental authorisation for children under 13.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/how-do-we-process-biometric-data-lawfully/) — Processing biometric data for unique identification purposes constitutes special category processing under UK GDPR Article 9, requiring both an Article 6 lawful basis and a separate Article 9/DPA 2018 Schedule 1 condition, with explicit consent typically the most applicable condition.observed 2026-07-28