The new s78A, introduced by s88 of the Data (Use and Access) Act (DUAA) 2025 (1), significantly expands the national security exemption under Part 3 of the Data Protection Act (DPA) 2018 (2), which governs law enforcement processing.
Here’s a breakdown of what’s changed and what it means for competent authorities.
The Data (Use and Access) Act (DUAA) 2025 introduces critical updates to Subject Access Requests (SARs), specifically for competent authorities operating under Part 3 of the Data Protection Act (DPA) 2018. The changes now enable competent authorities to take longer to respond to requests to access personal information, if you need extra time because of the complexity or number of requests that someone has made. It also makes it clear that you only need to make reasonable sear