Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Annex 1 – LAWFULNESS OF PROCESSING: RECOGNISED LEGITIMATE INTERESTS

Annexes

Annex 1[^F1 LAWFULNESS OF PROCESSING: RECOGNISED LEGITIMATE INTERESTS

Disclosure for purposes of processing described in Article 6(1)(e)

1 This condition is met where—

(a)
the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and
(b)
the request states that the other person needs the personal data for the purposes of carrying out processing described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3).

National security, public security and defence

2 This condition is met where the processing is necessary—

(a)
for the purposes of safeguarding national security,
(b)
for the purposes of protecting public security, or
(c)
for defence purposes.

Emergencies

3 This condition is met where the processing is necessary for the purposes of responding to an emergency.

4 In paragraph 3, “emergency” has the same meaning as in Part 2 of the Civil Contingencies Act 2004.

Crime

5 This condition is met where the processing is necessary for the purposes of—

(a)
detecting, investigating or preventing crime, or
(b)
apprehending or prosecuting offenders.

Safeguarding vulnerable individuals

6 This condition is met where the processing is necessary for the purposes of safeguarding a vulnerable individual.

7 In paragraph 6—

“safeguarding”, in relation to a vulnerable individual, means—
- (a)
  protecting a vulnerable individual from neglect or physical, mental or emotional harm, or
- (b)
  protecting the physical, mental or emotional well-being of a vulnerable individual;
“vulnerable individual” means an individual—
- (a)
  aged under 18, or
- (b)
  aged 18 or over and at risk.

8 For the purposes of paragraph 7—

(a)
protection of an individual, or of the well-being of an individual, includes both protection relating to a particular individual and protection relating to a type of individual, and
(b)
an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—
- (i)
  has needs for care and support,
- (ii)
  is experiencing, or at risk of, neglect or physical, mental or emotional harm, and
- (iii)
  as a result of those needs is unable to protect themselves against the neglect, harm or risk.]

Amended text

This Annex is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations and footnotes

Textual Amendments

F1 Annex 1 inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 4; S.I. 2026/82, reg. 2(z6)

https://uk-gdpr.digiphile.law/annex/annex-1.html

Text as at 17 September 2026.

This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.