Section 82C — Data Protection Act 2018: Review and withdrawal of designation notice

Review and withdrawal of designation notice 82C 1 Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force.

2 A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security.

3 A person who applied for the designation of the processing must, on a request from the Secretary of State, provide—

a a description of the processing that is being, or is intended to be, carried out in reliance on the notice, and b an explanation of why the person considers that designation of the processing continues to be required for the purposes of safeguarding national security.

4 The Secretary of State must at least annually—

a review each designation notice that is for the time being in force, and b consider whether designation of the processing which is the subject of the notice continues to be required for the purposes of safeguarding national security.

5 The Secretary of State—

a may withdraw a designation notice by giving a further notice (a “withdrawal notice”) to the persons who applied for the designation, and b must give a withdrawal notice if the Secretary of State considers that designation of some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security (whether as a result of a review required under subsection (4) or otherwise).

6 A withdrawal notice must—

a withdraw the designation notice completely, and b state when it comes into force.

7 In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider—

a the desirability of the processing ceasing to be designated as soon as possible, and b where relevant, the time needed to effect an orderly transition to new arrangements for the processing of personal data.