Part 2: General processing Chapter 2: The GDPR Section 15: Exemptions etc
Subsections (1) to (4) of this section are self-explanatory and signposts the relative restrictions to data subject rights under the GDPR.
	Subsection (5) is a distinct signposting provision. National security and defence are outside the scope of EU law. Consequently, for example, the processing of personal data in connection with national security activities, and by agencies or units dealing with national security issues, is not within the scope of the GDPR. As a result, save where the provisions of Parts 3 (law enforcement processing) and 4 (intelligence services processing) apply, any processing of personal data in connection with safeguarding national security or defence is governed by the applied GDPR scheme provided for in Chapter 3 of Part 2, subject to the appropriate application of the exemptions provided for in sections 26 to 28. Where national security or is engaged, subsection (5) therefore signposts data controllers, processors and others to the applied GDPR scheme.