(c) for defence purposes.
Emergencies
3. This condition is met where the processing is necessary for the purposes of responding to an emergency.
4. In paragraph 3, “ emergency ” has the same meaning as in Part 2 of the Civil Contingencies Act 2004.
Crime
5. This condition is met where the processing is necessary for the purposes of—
(a) detecting, investigating or preventing crime, or
(b) apprehending or prosecuting offenders.
Safeguarding vulnerable individuals
6. This condition is met where the processing is necessary for the purposes of safeguarding a vulnerable individual.
7. In paragraph 6—
“ safeguarding ”, in relation to a vulnerable individual, means— (a) protecting a vulnerable individual from neglect or physical, mental or emotional harm, or (b) protecting the physical, mental or emotional well-being of a vulnerable individual;
“ vulnerable individual ” means an individual— (a) aged under 18, or (b) aged 18 or over and at risk.
8. For the purposes of paragraph 7—
(a) protection of an individual, or of the well-being of an individual, includes both protection relating to a particular individual and protection relating to a type of individual, and
(b) an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—
(i) has needs for care and support,
(ii) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and
(iii) as a result of those needs is unable to protect themselves against the neglect, harm or risk. ”
Section 71
Schedule 5 U.K. Purpose limitation: processing to be treated as compatible with original purpose
I291 Sch. 5 not in force at Royal Assent, see s. 142(1)
I292 Sch. 5 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z7)
In the UK GDPR, after Annex 1 (inserted by Schedule 4 to this Act) insert—
“ ANNEX 2 U.K. PURPOSE LIMITATION: PROCESSING TO BE TREATED AS COMPATIBLE WITH ORIGINAL PURPOSE
(a) the processing—