At a glance

  • The GDPR and the Data Protection Act 2018 set out exemptions from some of the rights and obligations in some circumstances.
  • Whether or not you can rely on an exemption often depends on why you process personal data.
  • You should not routinely rely on exemptions; you should consider them on a case-by-case basis.
  • You should justify and document your reasons for relying on an exemption.
  • If no exemption covers what you do with personal data, you need to comply with the GDPR as normal.

Checklists

Exemptions

We consider whether we can rely on an exemption on a case-by-case basis.

Where appropriate, we carefully consider the extent to which the relevant GDPR requirements would be likely to prevent, seriously impair, or prejudice the achievement of our processing purposes.

We justify and document our reasons for relying on an exemption.

When an exemption does not apply (or no longer applies) to our processing of personal data, we comply with the GDPR’s requirements as normal.

In brief

What’s new under the GDPR and the Data Protection Act 2018?

Not much has changed. Most of the exemptions in the Data Protection Act 1998 (the 1998 Act) are included as exceptions built in to certain GDPR provisions or exemptions in the Data Protection Act 2018 (the DPA 2018).

The ‘domestic purposes’ exemption in the 1998 Act is not replicated. This is because the GDPR does not apply to personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity.

If you used to rely on certain exemptions under the 1998 Act, the things you are exempt from may have changed slightly under the GDPR and the DPA 2018. You should check what is covered by the exemptions in the DPA 2018 and ensure that your use of any of the exemptions is appropriate and compliant.

What are exemptions?

In some circumstances, the DPA 2018 provides an exemption from particular GDPR provisions. If an exemption applies, you may not have to comply with all the usual rights and obligations.

There are several different exemptions; these are detailed in Schedules 2-4 of the DPA 2018. They add to and complement a number of exceptions already built in to certain GDPR provisions.

This part of the Guide focuses on the exemptions in Schedules 2-4 of the DPA 2018. We give guidance on the exceptions built in to the GDPR in the parts of the Guide that relate to the relevant provisions.

The exemptions in the DPA 2018 can relieve you of some of your obligations for things such as:

  • the right to be informed;
  • the right of access;
  • dealing with other individual rights;
  • reporting personal data breaches; and
  • complying with the principles.

Some exemptions apply to only one of the above, but others can exempt you from several things.

Some things are not exemptions. This is simply because they are not covered by the GDPR. Here are some examples:

  • Domestic purposes – personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity, is outside the GDPR’s scope. This means that if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the GDPR.
  • Law enforcement – the processing of personal data by competent authorities for law enforcement purposes is outside the GDPR’s scope (e.g. the Police investigating a crime). Instead, this type of processing is subject to the rules in Part 3 of the DPA 2018. See our Guide to Law Enforcement Processing for further information.
  • National security – personal data processed for the purposes of safeguarding national security or defence is outside the GDPR’s scope. However, it is covered by Part 2, Chapter 3 of the DPA 2018 (the ‘applied GDPR’), which contains an exemption for national security and defence.

How do exemptions work?

Whether or not you can rely on an exemption generally depends on your purposes for processing personal data.

Some exemptions apply simply because you have a particular purpose. But others only apply to the extent that complying with the GDPR would:

  • be likely to prejudice your purpose (e.g. have a damaging or detrimental effect on what you are doing); or
  • prevent or seriously impair you from processing personal data in a way that is required or necessary for your purpose.

Exemptions should not routinely be relied upon or applied in a blanket fashion. You must consider each exemption on a case-by-case basis.

If an exemption does apply, sometimes you will be obliged to rely on it (for instance, if complying with GDPR would break another law), but sometimes you can choose whether or not to rely on it.

In line with the accountability principle, you should justify and document your reasons for relying on an exemption so you can demonstrate your compliance.

If you cannot identify an exemption that covers what you are doing with personal data, you must comply with the GDPR as normal.

What exemptions are available?

Crime, law and public protection

Regulation, parliament and the judiciary

Journalism, research and archiving

Health, social work, education and child abuse

Finance, management and negotiations

References and exams

Subject access requests – information about other people

Crime and taxation: general

There are two parts to this exemption. The first part can apply if you process personal data for the purposes of:

  • the prevention and detection of crime;
  • the apprehension or prosecution of offenders; or
  • the assessment or collection of a tax or duty or an imposition of a similar nature.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling;
  • notifying individuals of personal data breaches;
  • the lawfulness, fairness and transparency principle, except the requirement for processing to be lawful;
  • the purpose limitation principle; and
  • all the other principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with these provisions would be likely to prejudice your purposes of processing. If this is not so, you must comply with the GDPR as normal.

Example

A bank conducts an investigation into suspected financial fraud. The bank wants to pass its investigation file, including the personal data of several customers, to the National Crime Agency (NCA) for further investigation. The bank’s investigation and proposed disclosure to the NCA are for the purposes of the prevention and detection of crime. The bank decides that, were it to inform the individuals in question about this processing of their personal data, this would be likely to prejudice the investigation because they might abscond or destroy evidence. So the bank relies on the crime and taxation exemption and, in this case, does not comply with the right to be informed.

The second part of this exemption applies when another controller obtains personal data processed for any of the purposes mentioned above for the purposes of discharging statutory functions. The controller that obtains the personal data is exempt from the GDPR provisions below to the same extent that the original controller was exempt:

  • The right to be informed.
  • The right of access.
  • All the principles, but only so far as they relate to the right to be informed and the right of access.

Note that if you are a competent authority processing personal data for law enforcement purposes (e.g. the Police conducting a criminal investigation), your processing is subject to the rules of Part 3 of the DPA 2018. See our Guide to Law Enforcement Processing for information on how individual rights may be restricted when personal data is processed for law enforcement purposes by competent authorities.

Crime and taxation: risk assessment

This exemption can apply to personal data in a classification applied to an individual as part of a risk assessment system.

The risk assessment system must be operated by a government department, local authority, or another authority administering housing benefit, for the purposes of:

  • the assessment or collection of a tax or duty; or
  • the prevention or detection of crime or the apprehension or prosecution of offenders, where the offence involves the unlawful use of public money or an unlawful claim for payment out of public money.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access;
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

But the exemption only applies to the extent that complying with these provisions would prevent the risk assessment system from operating effectively. If this is not so, you must comply with these provisions as normal.

Information required to be disclosed by law or in connection with legal proceedings

This exemption has three parts. The first part can apply if you are required by law to make personal data available to the public.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling;
  • the lawfulness, fairness and transparency principle, except the requirement for processing to be lawful;
  • the purpose limitation principle; and
  • all the other principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with these provisions would prevent you meeting your legal obligation to make personal data publicly available.

Example

The Registrar of Companies is legally obliged to maintain a public register of certain information about companies, including the names and (subject to certain restrictions) addresses of company directors. A director asks to exercise his right to erasure by having his name and address removed from the register. The request does not need to be complied with as it would prevent the Registrar meeting his legal obligation to make that information publicly available.

The second part of this exemption can apply if you are required by law, or court order, to disclose personal data to a third party. It exempts you from the same provisions as above, but only to the extent that complying with those provisions would prevent you disclosing the personal data.

Example

An employer receives a court order to hand over the personnel file of one of its employees to an insurance company for the assessment of a claim. Normally, the employer would not be able to disclose this information because doing so would be incompatible with the original purposes for collecting the data (contravening the purpose limitation principle). However, on this occasion the employer is exempt from the purpose limitation principle’s requirements because it would prevent the employer disclosing personal data that it must do by court order.

The third part of this exemption can apply if it is necessary for you to disclose personal data for the purposes of, or in connection with:

  • legal proceedings, including prospective legal proceedings;
  • obtaining legal advice; or
  • establishing, exercising or defending legal rights.

It exempts you from the same provisions as above, but only to the extent that complying with them would prevent you disclosing the personal data. If complying with these provisions would not prevent the disclosure, you cannot rely on the exemption.

Legal professional privilege

This exemption applies if you process personal data:

  • to which a claim to legal professional privilege (or confidentiality of communications in Scotland) could be maintained in legal proceedings; or
  • in respect of which a duty of confidentiality is owed by a professional legal adviser to his client.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access; and
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

Self incrimination

This exemption can apply if complying with the GDPR provisions below would reveal evidence that you have committed an offence.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access; and
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

But the exemption only applies to the extent that complying with these provisions would expose you to proceedings for the offence.

This exemption does not apply to an offence under the DPA 2018 or an offence regarding false statements made otherwise than on oath.

But any information you do provide to an individual in response to a subject access request is not admissible against you in proceedings for an offence under the DPA 2018.

Disclosure prohibited or restricted by an enactment

Five separate exemptions apply to personal data that is prohibited or restricted from disclosure by an enactment.

Each of them exempts you from the GDPR’s provisions on:

  • the right of access; and
  • all the principles, but only so far as they relate to the right of access.

But the exemptions only apply to personal data restricted or prohibited from disclosure by certain specific provisions of enactments covering:

  • human fertilisation and embryology;
  • adoption;
  • special educational needs;
  • parental orders; and
  • children’s hearings.

If you think any of these exemptions might apply to your processing of personal data, see Schedule 4 of the DPA 2018 for full details of the enactments that are covered.

Immigration

There are two parts to this exemption. The first part can apply if you process personal data for the purposes of maintaining effective immigration control, including investigatory/detection work (the immigration purposes).

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access;
  • the right to erasure;
  • the right to restrict processing;
  • the right to object;
  • all the principles, but only so far as they relate to the rights to be informed, of access, to erasure, to restrict processing and to object.

But the exemption only applies to the extent that applying these provisions would be likely to prejudice processing for the immigration purposes. If not, the exemption does not apply.

The second part of this exemption applies when personal data processed by any controller is obtained and processed by another controller for the immigration purposes. The controller that discloses the personal data is exempt from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access;
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

The exemption only applies to the same extent that the second controller is exempt from these provisions.

Functions designed to protect the public

This exemption can apply if you process personal data for the purposes of discharging one of six functions designed to protect the public.

The first four functions must: be conferred on a person by enactment; be a function of the Crown, a Minister of the Crown or a government department; or be of a public nature and exercised in the public interest. These functions are:

  1. to protect the public against financial loss due to the seriously improper conduct (or unfitness, or incompetence) of financial services providers, or in the management of bodies corporate, or due to the conduct of bankrupts;
  2. to protect the public against seriously improper conduct (or unfitness, or incompetence);
  3. to protect charities or community interest companies against misconduct or mismanagement in their administration, to protect the property of charities or community interest companies from loss or misapplication, or to recover the property of charities or community interest companies; or
  4. to secure workers’ health, safety and welfare or to protect others against health and safety risks in connection with (or arising from) someone at work.

The fifth function must be conferred by enactment on: the Parliamentary Commissioner for Administration; the Commissioner for Local Administration in England; the Health Service Commissioner for England; the Public Services Ombudsman for Wales; the Northern Ireland Public Services Ombudsman; the Prison Ombudsman for Northern Ireland; or the Scottish Public Services Ombudsman. This function is:

  1. to protect the public from maladministration, or a failure in services provided by a public body, or from the failure to provide a service that it is a function of a public body to provide.

The sixth function must be conferred by enactment on the Competition and Markets Authority. This function is:

  1. to protect members of the public from business conduct adversely affecting them, to regulate conduct (or agreements) preventing, restricting or distorting commercial competition, or to regulate undertakings abusing a dominant market position.

If you process personal data for any of the above functions, you are exempt from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If you can comply with these provisions and discharge your functions as normal, you must do so.

Audit functions

This exemption can apply if you process personal data for the purposes of discharging a function conferred by enactment on:

  • the Comptroller and Auditor General;
  • the Auditor General for Scotland;
  • the Auditor General for Wales; or
  • the Comptroller and Auditor General for Northern Ireland.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If it does not, you must comply with the GDPR as normal.

Bank of England functions

This exemption can apply if you process personal data for the purposes of discharging a function of the Bank of England:

  • in its capacity as a monetary authority;
  • that is a public function (within the meaning of Section 349 of the Financial Services and Markets Act 2000); or
  • that is conferred on the Prudential Regulation Authority by enactment.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If this is not so, the exemption does not apply.

Regulatory functions relating to legal services, the health service and children’s services

This exemption can apply if you process personal data for the purposes of discharging a function of:

  • the Legal Services Board;
  • considering a complaint under:
    • Part 6 of the Legal Services Act 2007,
    • Section 14 of the NHS Redress Act 2006,
    • Section 113(1) or (2), or Section 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003,
    • Section 24D or 26 of the Children’s Act 1989, or
    • Part 2A of the Public Services Ombudsman (Wales) Act 2005; or
  • considering a complaint or representations under Chapter 1, Part 10 of the Social Services and Well-being (Wales) Act 2014.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your functions. If you can comply with these provisions and discharge your functions as normal, you cannot rely on the exemption.

Other regulatory functions

This exemption can apply if you process personal data for the purpose of discharging a regulatory function conferred under specific, listed legislation on any one of 14 bodies and persons. These are:

  • the Information Commissioner;
  • the Scottish Information Commissioner;
  • the Pensions Ombudsman;
  • the Board of the Pension Protection Fund;
  • the Ombudsman for the Board of the Pension Protection Fund;
  • the Pensions Regulator;
  • the Financial Conduct Authority;
  • the Financial Ombudsman;
  • the investigator of complaints against the financial regulators;
  • a consumer protection enforcer (other than the Competition and Markets Authority);
  • the monitoring officer of a relevant authority;
  • the monitoring officer of a relevant Welsh authority;
  • the Public Services Ombudsman for Wales; or
  • the Charity Commission.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with these provisions would be likely to prejudice the proper discharge of your function. If this is not so, you must comply with these provisions as you normally would.

Parliamentary privilege

This exemption can apply if it is required to avoid the privileges of either House of Parliament being infringed.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling;
  • the communication of personal data breaches to individuals; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But if you can comply with these provisions without infringing parliamentary privilege, you must do so.

Judicial appointments, independence and proceedings

This exemption applies if you process personal data:

  • for the purposes of assessing a person’s suitability for judicial office or the office of Queen’s Counsel;
  • as an individual acting in a judicial capacity; or
  • as a court or tribunal acting in its judicial capacity.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

Additionally, even if you do not process personal data for the reasons above, you are also exempt from the same provisions of the GDPR to the extent that complying with them would be likely to prejudice judicial independence or judicial proceedings.

Crown honours, dignities and appointments

This exemption applies if you process personal data for the purposes of:

  • conferring any honour or dignity by the Crown; or
  • assessing a person’s suitability for any of the following offices:
    • archbishops and diocesan and suffragan bishops in the Church of England,
    • deans of cathedrals of the Church of England,
    • deans and canons of the two Royal Peculiars,
    • the First and Second Church Estates Commissioners,
    • lord-lieutenants,
    • Masters of Trinity College and Churchill College, Cambridge,
    • the Provost of Eton,
    • the Poet Laureate, or
    • the Astronomer Royal.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

Journalism, academia, art and literature

This exemption can apply if you process personal data for:

  • journalistic purposes;
  • academic purposes;
  • artistic purposes; or
  • literary purposes.

Together, these are known as the ‘special purposes’.

The exemption relieves you from your obligations regarding the GDPR’s provisions on:

  • all the principles, except the security and accountability principles;
  • the lawful bases;
  • the conditions for consent;
  • children’s consent;
  • the conditions for processing special categories of personal data and data about criminal convictions and offences;
  • processing not requiring identification;
  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling;
  • the communication of personal data breaches to individuals;
  • consultation with the ICO for high risk processing;
  • international transfers of personal data; and
  • cooperation and consistency between supervisory authorities.

But the exemption only applies to the extent that:

  • as controller for the processing of personal data, you reasonably believe that compliance with these provisions would be incompatible with the special purposes (this must be more than just an inconvenience);
  • the processing is being carried out with a view to the publication of some journalistic, academic, artistic or literary material; and
  • you reasonably believe that the publication of the material would be in the public interest, taking into account the special importance of the general public interest in freedom of expression, any specific public interest in the particular subject, and the potential to harm individuals.

When deciding whether it is reasonable to believe that publication would be in the public interest, you must (if relevant) have regard to:

  • the BBC Editorial Guidelines;
  • the Ofcom Broadcasting Code; and
  • the Editors’ Code of Practice.

We expect you to be able to explain why the exemption is required in each case, and how and by whom this was considered at the time. The ICO does not have to agree with your view – but we must be satisfied that you had a reasonable belief.

Research and statistics

This exemption can apply if you process personal data for:

  • scientific or historical research purposes; or
  • statistical purposes.

It does not apply to the processing of personal data for commercial research purposes such as market research or customer satisfaction surveys.

It exempts you from the GDPR’s provisions on:

  • the right of access;
  • the right to rectification;
  • the right to restrict processing; and
  • the right to object.

The GDPR also provides exceptions from its provisions on the right to be informed (for indirectly collected data) and the right to erasure.

But the exemption and the exceptions only apply:

  • to the extent that complying with the provisions above would prevent or seriously impair the achievement of the purposes for processing;
  • if the processing is subject to appropriate safeguards for individuals’ rights and freedoms (see Article 89(1) of the GDPR – among other things, you must implement data minimisation measures);
  • if the processing is not likely to cause substantial damage or substantial distress to an individual;
  • if the processing is not used for measures or decisions about particular individuals, except for approved medical research; and
  • as regards the right of access, the research results are not made available in a way that identifies individuals.

Additionally, the GDPR contains specific provisions that adapt the application of the purpose limitation and storage limitation principles when you process personal data for scientific or historical research purposes, or statistical purposes. See the Guide pages on these principles for more detail.

Archiving in the public interest

This exemption can apply if you process personal data for archiving purposes in the public interest.

It exempts you from the GDPR’s provisions on:

  • the right of access;
  • the right to rectification;
  • the right to restrict processing;
  • the obligation to notify others regarding rectification, erasure or restriction;
  • the right to data portability; and
  • the right to object.

The GDPR also provides exceptions from its provisions on the right to be informed (for indirectly collected data) and the right to erasure.

But the exemption and the exceptions only apply:

  • to the extent that complying with the provisions above would prevent or seriously impair the achievement of the purposes for processing;
  • if the processing is subject to appropriate safeguards for individuals’ rights and freedoms (see Article 89(1) of the GDPR – among other things, you must implement data minimisation measures);
  • if the processing is not likely to cause substantial damage or substantial distress to an individual; and
  • if the processing is not used for measures or decisions about particular individuals, except for approved medical research.

Additionally, the GDPR contains specific provisions that adapt the application of the purpose limitation and storage limitation principles when you process personal data for archiving purposes in the public interest. See the Guide pages on these principles for more detail.

Further reading – The National Archives

The National Archives is the official archive and publisher for the UK Government and for England and Wales. It has published a detailed guide to archiving personal data.

Health data – processed by a court

This exemption can apply to health data (personal data concerning health) that is processed by a court.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies if the health data is:

  • supplied in a report or evidence given to the court in the course of proceedings; and
  • those proceedings are subject to certain specific statutory rules that allow the data to be withheld from the individual it relates to.

If you think this exemption might apply to your processing of personal data, see paragraph 3(2) of Schedule 3, Part 2 of the DPA 2018 for full details of the statutory rules.

Health data – an individual’s expectations and wishes

This exemption can apply if you receive a request (in exercise of a power conferred by an enactment or rule of law) for health data from:

  • someone with parental responsibility for an individual aged under 18 (or 16 in Scotland); or
  • someone appointed by the court to manage the affairs of an individual who is incapable of managing their own affairs.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with the request would disclose information that:

  • the individual provided in the expectation that it would not be disclosed to the requestor, unless the individual has since expressly indicated that they no longer have that expectation;
  • was obtained as part of an examination or investigation to which the individual consented in the expectation that the information would not be disclosed in this way, unless the individual has since expressly indicated that they no longer have that expectation; or
  • the individual has expressly indicated should not be disclosed in this way.

Health data – serious harm

This exemption can apply if you receive a subject access request for health data.

It exempts you from the GDPR’s provisions on the right of access regarding your processing of health data.

But the exemption only applies to the extent that compliance with the right of access would be likely to cause serious harm to the physical or mental health of any individual. This is known as the ‘serious harm test’ for health data.

You can only rely on this exemption if:

  • you are a health professional; or
  • within the last six months you have obtained an opinion from an appropriate health professional that the serious harm test for health data is met. Even if you have done this, you still cannot rely on the exemption if it would be reasonable in all the circumstances to re-consult the appropriate health professional.

If you think this exemption might apply to a subject access request you have received, see paragraph 2(1) of Schedule 3, Part 2 of the DPA 2018 for full details of who is considered an appropriate health professional.

Health data – restriction of the right of access

This is a restriction rather than an exemption. It applies if you receive a subject access request for health data.

It restricts you from disclosing health data in response to a subject access request, unless:

  • you are a health professional; or
  • within the last six months you have obtained an opinion from an appropriate health professional that the serious harm test for health data is not met. Even if you have done this, you must re-consult the appropriate health professional if it would be reasonable in all the circumstances.

This restriction does not apply if you are satisfied that the health data has already been seen by, or is known by, the individual it is about.

If you think this restriction could apply to a subject access request you have received, see paragraph 2(1) of Schedule 3, Part 2 of the DPA 2018 for full details of who is considered an appropriate health professional.

Social work data – processed by a court

This exemption can apply to social work data (personal data that isn’t health or education data) processed by a court. If you are unsure whether the data you process is social work data, see paragraphs 7(1) and 8 of Schedule 3, Part 3 of the DPA 2018 for full details of what this is.

The exemption relieves you from your obligations regarding the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies if the social work data is:

  • supplied in a report or evidence given to the court in the course of proceedings; and
  • those proceedings are subject to certain specific statutory rules that allow the social work data to be withheld from the individual it relates to.

If you think this exemption might apply to your processing of personal data, see paragraph 9(2) of Schedule 3, Part 3 of the DPA 2018 for full details of the statutory rules.

Social work data – an individual’s expectations and wishes

This exemption can apply if you receive a request (in exercise of a power conferred by an enactment or rule of law) for social work data concerning an individual from:

  • someone with parental responsibility for an individual aged under 18 (or 16 in Scotland); or
  • someone appointed by court to manage the affairs of an individual who is incapable of managing their own affairs.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies to the extent that complying with the request would disclose information that:

  • the individual provided in the expectation that it would not be disclosed to the requestor, unless the individual has since expressly indicated that they no longer have that expectation;
  • was obtained as part of an examination or investigation to which the individual consented in the expectation that the information would not be disclosed in this way, unless the individual has since expressly indicated that they no longer have that expectation; or
  • the individual has expressly indicated should not be disclosed in this way.

Social work data – serious harm

This exemption can apply if you receive a subject access request for social work data.

It exempts you from the GDPR’s provisions on the right of access regarding your processing of social work data.

But the exemption only applies to the extent that complying with the right of access would be likely to prejudice carrying out social work because it would be likely to cause serious harm to the physical or mental health of any individual. This is known as the ‘serious harm test’ for social work data.

Social work data – restriction of the right of access

This is a restriction rather than an exemption. It applies if you process social work data as a local authority in Scotland (as defined by the Social Work (Scotland) Act 1968), and you receive a subject access request for that data.

It restricts you from disclosing social work data in response to a subject access request if:

  • the data came from the Principal Reporter (as defined by the Children’s Hearings (Scotland) Act 2011) in the course of his statutory duties; and
  • the individual whom the data is about is not entitled to receive it from the Principal Reporter.

If there is a question as to whether you need to comply with a subject access request in this situation, you must inform the Principal Reporter within 14 days of the question arising.

You must not disclose the social work data in response to the subject access request unless the Principal Reporter has told you they think the serious harm test for social work data is not met.

Education data – processed by a court

This exemption can apply to education data (personal data in an educational record) processed by a court. If you are unsure whether the data you process is ‘education data’, see paragraphs 13-17 of Schedule 3, Part 4 of the DPA 2018 for full details of what this is.

The exemption relieves you from your obligations regarding the GDPR’s provisions on:

  • the right to be informed;
  • all the other individual rights, except rights related to automated individual decision-making including profiling; and
  • all the principles, but only so far as they relate to the right to be informed and the other individual rights.

But the exemption only applies if the education data is:

  • supplied in a report or evidence given to the court in the course of proceedings; and
  • those proceedings are subject to certain specific statutory rules that allow the education data to be withheld from the individual it relates to.

If you think this exemption might apply to your processing of personal data, see paragraph 18(2) of Schedule 3, Part 4 of the DPA 2018 for full details of the statutory rules.

Education data – serious harm

This exemption can apply if you receive a subject access request for education data.

It exempts you from the GDPR’s provisions on the right of access regarding your processing of education data.

But the exemption only applies to the extent that complying with the right of access would be likely to cause serious harm to the physical or mental health of any individual. This is known as the ‘serious harm test’ for education data.

Education data – restriction of the right of access

This is a restriction rather than an exemption. It applies if you process education data as an education authority in Scotland (as defined by the Education (Scotland) Act 1980), and you receive a subject access request for that data.

It restricts you from disclosing education data in response to a subject access request if:

  • you believe that the data came from the Principal Reporter (as defined by the Children’s Hearings (Scotland) Act 2011) in the course of his statutory duties; and
  • the individual whom the data is about is not entitled to receive it from the Principal Reporter.

If there is a question as to whether you need to comply with a subject access request in this situation, you must inform the Principal Reporter within 14 days of the question arising.

You must not disclose the education data in response to the subject access request unless the Principal Reporter has told you they think the serious harm test for education data is not met.

Child abuse data

This exemption can apply if you receive a request (in exercise of a power conferred by an enactment or rule of law) for child abuse data. If you are unsure whether the data you process is ‘child abuse data’, see paragraph 21(3) of Schedule 3, Part 5 of the DPA 2018 for a definition.

The exemption applies if the request is from:

  • someone with parental responsibility for an individual aged under 18; or
  • someone appointed by court to manage the affairs of an individual who is incapable of managing their own affairs.

It exempts you from the GDPR’s provisions on the right of access.

But the exemption only applies to the extent that complying with the request would not be in the best interests of the individual who the child abuse data is about.

This exemption can only apply in England, Wales and Northern Ireland. It cannot apply in Scotland.

Corporate finance

This exemption can apply if you process personal data in connection with a corporate finance service (e.g. if you underwrite financial instruments or give corporate finance advice to undertakings) that you are permitted to provide (as set out in the Financial Services and Markets Act 2000).

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access; and
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

But the exemption only applies to the extent that complying with the provisions above would:

  • be likely to affect the price of an instrument; or
  • have a prejudicial effect on the orderly functioning of financial markets (or the efficient allocation of capital within the economy), and you reasonably believe that complying with the provisions above could affect someone’s decision whether to:
    • deal in, subscribe for or issue a financial instrument, or
    • act in a way likely to have an effect on a business activity (e.g. an effect on an undertaking’s capital structure, the legal or beneficial ownership of a business or asset or a person’s industrial strategy

Management forecasts

This exemption can apply if you process personal data for the purposes of management forecasting or management planning in relation to a business or other activity.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access; and
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

But the exemption only applies to the extent that compliance with the above provisions would be likely to prejudice the conduct of the business or activity.

Example

The senior management of an organisation is planning a re-organisation. This is likely to involve making certain employees redundant, and this possibility is included in management plans. Before the plans are revealed to the workforce, an employee makes a subject access request. In responding to that request, the organisation does not have to reveal its plans to make him redundant if doing so would be likely to prejudice the conduct of the business (perhaps by causing staff unrest before the management’s plans are announced).

Negotiations

This exemption can apply to personal data in records of your intentions relating to any negotiations with an individual.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access; and
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

But it only applies to the extent that complying with the above provisions would be likely to prejudice negotiations with that individual.

Example

An individual makes a claim to his insurance company. The claim is for compensation for personal injuries he sustained in an accident. The insurance company disputes the seriousness of the injuries and the amount of compensation it should pay. An internal paper sets out the company’s position on these matters including the maximum sum it would be willing to pay to avoid the claim going to court. If the individual makes a subject access request to the insurance company, it would not have to send him the internal paper – because doing so would be likely to prejudice the negotiations to settle the claim.

Confidential references

This exemption applies if you give or receive a confidential reference for the purposes of prospective or actual:

  • education, training or employment of an individual;
  • placement of an individual as a volunteer;
  • appointment of an individual to office; or
  • provision by an individual of any service.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access; and
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

Example

Company A provides an employment reference in confidence for one of its employees to company B. If the employee makes a subject access request to company A or company B, the reference will be exempt from disclosure. This is because the exemption applies to the reference regardless of whether it is in the hands of the company that gives it or receives it.

Exam scripts and exam marks

This exemption can apply to personal data in exam scripts.

It exempts you from the GDPR’s provisions on:

  • the right to be informed;
  • the right of access; and
  • all the principles, but only so far as they relate to the right to be informed and the right of access.

But it only applies to the information recorded by candidates. This means candidates do not have the right to copies of their answers to the exam questions.

However, the information recorded by the person marking the exam is not exempt from the above provisions. If an individual makes a subject access request for this information before the results are announced, special rules apply to how long you have to comply with the request. You must provide the information:

  • within five months of receiving the request; or
  • within 40 days of announcing the exam results, if this is earlier.

Protection of the rights of others

Paragraphs 16 and 17 of Schedule 2, Part 3 of the DPA 2018 provide an exemption that can apply if you receive a subject access request for information containing the personal data of more than one individual.

See our Guide page on the right of access for guidance on what to do if you receive a request for information that includes the personal data of other people.