UK names qualifying bodies for DPA Part 4 in 2025

Teachers and students who track privacy and security, here’s the headline: the UK has confirmed which public bodies count as “qualifying competent authorities” under the Data Protection Act 2018, Part 4. That status lets them apply with an intelligence service for a designation notice so they can process personal data together under Part 4. The instrument was laid on 7 July 2025 and takes effect 21 days after it is made, across England, Wales, Scotland and Northern Ireland.

If you need a quick refresher, Part 4 is the rulebook that governs MI5, SIS and GCHQ. In June 2025 Parliament amended section 82 so Part 4 can also apply to joint processing by a public body once it is listed as a “qualifying competent authority” and the Secretary of State issues a designation notice. Regulations made under section 82 use the affirmative procedure, meaning both Houses must approve them.

So who is on the list? In plain terms: ministerial government departments (non‑ministerial departments are excluded); chief constables in England and Wales; the Metropolitan Police Commissioner; the City of London Police Commissioner; the Chief Constable of the Police Service of Northern Ireland; and the Chief Constable of Police Scotland.

The list also covers the heads of the British Transport Police, Civil Nuclear Constabulary and Ministry of Defence Police; the Provost Marshals for the Royal Navy Police, Royal Military Police, Royal Air Force Police and service serious crime; harbour and port constabularies created under historic Acts; collaboration bodies under section 22A of the Police Act 1996; HM Revenue and Customs; the Director General of the National Crime Agency; HM Land Registry; the Parole Boards in England and Wales and in Scotland; the Parole Commissioners and Probation Board in Northern Ireland; and providers in law who run electronic monitoring.

How a designation works in practice: the public body and at least one intelligence service must apply together. The application must describe the processing, set out the purposes and means, and explain why designation is required to safeguard national security. The Secretary of State must consult the Information Commissioner before giving any notice.

There are clear limits. A designation cannot be used for transfers to countries outside the UK or to international organisations. Any notice must state when it starts and normally expires after a maximum of five years, unless renewed or a shorter period is set.

Designations are not set‑and‑forget. Applicants must tell the Secretary of State if the designation is no longer needed and provide information for reviews; the Secretary of State can withdraw a notice if grounds fall away.

Transparency and challenge are built in. The Commissioner must publish a public record of each designation notice (with any sensitive parts withheld if necessary), and anyone directly affected can appeal to the Tribunal, which can quash a notice.

For teaching, this is useful because we can now explain joint data work under one rulebook. Try this scenario with your class: HMRC suspects terror‑financing and wants to work with MI5. A designation would put that joint work under Part 4, time‑limit it, and make oversight steps - consultation, publication, possible appeal - part of the story.

If you work in a listed body, look out for training. Part 4 is its own regime, not UK GDPR or the law‑enforcement rules in Part 3. The ICO’s guidance on intelligence‑services processing is being updated following the Data (Use and Access) Act coming into law on 19 June 2025, so plan for refreshed processes and documentation.

Media‑literacy pointers to share with students: the list is broad but defined; non‑ministerial departments are not included; Parliament had to approve the list via the affirmative procedure; and the instrument itself says no full impact assessment was produced. These are prompts to ask who benefits, who carries risk, and what the oversight looks like.

Dates for your slide deck: the instrument was laid before both Houses on 7 July 2025 and, once made on 27 October 2025, comes into force 21 days later - Monday 17 November 2025 - and applies across the UK. Mark that as the point when the list starts to bite.