DPA 2018: Exemptions (Schedule 2)

Exemptions (Schedule 2)

Rule: Schedule 2 of the DPA 2018 provides exemptions from various UK GDPR provisions. These exemptions limit data subject rights in specific circumstances where other interests take priority.

How Exemptions Work

Exemptions apply to specific UK GDPR provisions, not to all data protection obligations. Most commonly exempted:

Commonly Exempted	UK GDPR Article
Right of access	Art 15
Right to rectification	Art 16
Right to erasure	Art 17
Right to restriction	Art 18
Right to object	Art 21
Notification obligation	Art 19

Key Exemptions

Crime and Taxation [Para 2]

Exemption from data subject rights where compliance would prejudice:

• Prevention or detection of crime
• Apprehension or prosecution of offenders
• Assessment or collection of any tax or duty

Applies to: Art 15 (access), Art 16 (rectification), Art 17 (erasure), Art 18 (restriction), Art 21 (object)

Legal Professional Privilege [Para 19]

Personal data is exempt from data subject rights if:

• Consists of information subject to legal professional privilege
• Disclosure would reveal privileged communications

Applies to: Art 15 (access), Arts 16-21 (correction rights)

Journalism, Academia, Art, Literature [Para 26]

Exemption where processing is for special purposes (journalism, academic, artistic, literary) and:

• With a view to publication
• Controller reasonably believes publication is in the public interest
• Compliance would be incompatible with the special purposes

Applies to: Many UK GDPR provisions including Art 15, automated decision-making, and principles

Management Forecasts [Para 22]

Personal data processed for management forecasting or planning is exempt if disclosure would prejudice the business.

Applies to: Art 15 (access)

Negotiations [Para 23]

Data about negotiations with the data subject is exempt if disclosure would prejudice the negotiations.

Applies to: Art 15 (access)

Confidential References [Para 24]

Confidential references given by controller for:

• Education, training, or employment
• Appointment to office
• Provision of services

Applies to: Art 15 (access)

Exam Scripts and Marks [Para 25]

Data about exam performance is exempt from access rights during marking period.

Applies to: Art 15 (access) — temporarily

Health, Education, Social Work Data [Paras 3-5]

Exemptions where disclosure would cause serious harm:

• Health data — Likely to cause serious harm to physical/mental health
• Education data — Likely to cause serious harm
• Social work data — Would prejudice social work functions

Applies to: Art 15 (access)

Table of Main Exemptions

Exemption	Grounds	Key GDPR Rights Affected
Crime/taxation	Would prejudice law enforcement	Access, rectification, erasure
Legal privilege	Privileged communications	Access, correction rights
Journalism	Public interest publication	Broad exemption
Management planning	Would prejudice business	Access
Negotiations	Would prejudice negotiations	Access
References	Confidential reference	Access
Health/education/social work	Serious harm	Access
Research	Compatible with research purposes	Access, rectification, restriction, object
National security	Certificate issued	Broad exemption

National Security [Para 1]

Exemption from any UK GDPR provision if required for national security.

• Minister may issue certificate
• Certificate is conclusive evidence
• Can be appealed to Tribunal

Research Exemption [Para 27]

Processing for research purposes (scientific, historical, statistical) exempt from:

• Art 15 (access) — if prejudices research
• Art 16 (rectification)
• Art 17 (erasure)
• Art 18 (restriction)
• Art 21 (object)

Conditions:

• Research in public interest
• Results not made available identifying individuals
• Appropriate safeguards

Important Notes

1. Exemptions are not automatic — Controller must assess whether exemption actually applies
2. Partial exemption possible — May redact exempt portions and disclose rest
3. Must be necessary — Most exemptions require that compliance would cause the harm/prejudice
4. Document decisions — Record why exemption was applied

Citation

Schedule 2, Data Protection Act 2018