National security certificates prior to the Data Protection Act 2018 (DPA 2018) were dealt with under Section 28 of the Data Protection Act 1998 (DPA 1998), which states: ‘a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in subsection (1) is or at any time was required for the purpose there mentioned in respect of any personal data shall be conclusive evidence of that fact.’ This allowed for the Secretary of State to issue certificates whilst disregarding data protection principles ‘for the purpose of safeguarding national security’, as per the exemptions laid out in DPA 1998, s 28(1). DPA 1998, s 28 has now been repealed by DPA 2018, s 211(1)(a) and Sch 19, Pt 1, para 44. However, DPA 2018, Sch 20, Pt 5, para 17(2) provides that: ‘A certificate issued under section 28(2) of the 1998 Act continues