Guide to Data Protection Act for Data Controllers

At a glance

• You are likely to be able to rely on vital interests as your legal basis for processing if you need to process the personal data to protect someone’s life.

• The processing must be necessary. If you can reasonably protect the person’s vital interests in another less intrusive way, this basis will not apply.

• You cannot rely on vital interests for health data or other sensitive personal data if the individual is capable of giving consent, even if they refuse their consent.

• You should consider whether you are likely to rely on this basis, and if so document the circumstances where it will be relevant and ensure you can justify your reasoning. 

In brief

• What does the DPA say?
• What are ‘vital interests’?
• When is the vital interests condition likely to apply?
• What else should you consider? 

What does the DPA say?

Paragraph 4 of Schedule 2 of the DPA says: 

This means that processing personal data is regarded lawful where it is necessary to protect an interest which is essential for the life of the data subject. 

What are ‘vital interests’?

Vital interests are intended to cover only interests that are essential for someone’s life. As such, this lawful basis is very limited in its scope, and generally only applies to matters of life and death. 

When is the vital interests condition likely to apply?

It is likely to be particularly relevant for emergency medical care, when you need to process personal data for medical purposes but the individual is incapable of giving consent to the processing. 

It is less likely to be appropriate for medical care that is planned in advance. Another lawful basis such as processing for the exercise of public functions or for legitimate interests is likely to be more appropriate (insofar as Schedule 2 of the DPA is concerned).

Vital interests is also less likely to be the appropriate basis for processing on a larger scale. It might apply where the processing is undertaken on humanitarian grounds such as monitoring epidemics, or where there is a natural or man-made disaster causing a humanitarian emergency.

However, if you are processing one person’s personal data to protect someone else’s life, you should generally use an alternative legal basis. For example, in many cases you could consider legitimate interests, which will give you a framework to balance the rights and interests of the data subject(s) with the vital interests of the person or people you are trying to protect. 

What else should you consider?

In most cases the protection of vital interests is likely to arise in the context of health data. This is one of sensitive personal data, which means you will also need to identify a condition for processing in Schedule 3 of the DPA. For more on sensitive personal data, see here. 

Relevant provisions

Data Protection Act (2021 Revision)

Schedule 2, paragraph 4: Legal conditions for processing