Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Schedule 2 – Exemptions etc from the UK GDPR

Schedules

Schedule 2Exemptions etc from the [F1UK GDPR]Section 15

PART 1 Adaptations and restrictions [F2as described in] Articles 6(3) and 23(1)

[F3UK GDPR] provisions to be adapted or restricted: “the listed GDPR provisions”

1 In this Part of this Schedule, “the listed GDPR provisions” means—
  • (a)
    the following provisions of the [F4UK GDPR] (the rights and obligations in which may be restricted by virtue of Article 23(1) of the [F4UK GDPR])—
    • (i)
      Article 13(1) to (3) (personal data collected from data subject: information to be provided);
    • (ii)
      Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
    • (iii)
      Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
    • (iv)
      Article 16 (right to rectification);
    • (v)
      Article 17(1) and (2) (right to erasure);
    • (vi)
      Article 18(1) (restriction of processing);
    • (vii)
      Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
    • (viii)
      Article 20(1) and (2) (right to data portability);
    • (ix)
      Article 21(1) (objections to processing);
    • (x)
      Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and
  • (b)
    the following provisions of the [F5UK GDPR] (the application of which may be adapted by virtue of Article 6(3) of the [F5UK GDPR])—
    • (i)
      Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;
    • (ii)
      F6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Crime and taxation: general

2
(1) The listed GDPR provisions and Article 34(1) and (4) of the [F7UK GDPR] (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—
  • (a)
    the prevention [F8, investigation] or detection of crime,
  • (b)
    the apprehension or prosecution of offenders, or
  • (c)
    the assessment or collection of a tax or duty or an imposition of a similar nature,

to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) to (c).

(2) Sub-paragraph (3) applies where—
  • (a)
    personal data is processed by a person (“Controller 1”) for any of the purposes mentioned in sub-paragraph (1)(a) to (c), and
  • (b)
    another person (“Controller 2”) obtains the data from Controller 1 for the purpose of discharging statutory functions and processes it for the purpose of discharging statutory functions.
(3) Controller 2 is exempt from the obligations in the following provisions of the [F9UK GDPR]—
  • (a)
    Article 13(1) to (3) (personal data collected from data subject: information to be provided),
  • (b)
    Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),
  • (c)
    Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers), and
  • (d)
    Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c),

to the same extent that Controller 1 is exempt from those obligations by virtue of sub-paragraph (1).

Crime and taxation: risk assessment systems

3
(1) The [F10UK GDPR] provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively.
(2) A risk assessment system falls within this sub-paragraph if—
  • (a)
    it is operated by a government department, a local authority or another authority administering housing benefit, and
  • (b)
    it is operated for the purposes of—
    • (i)
      the assessment or collection of a tax or duty or an imposition of a similar nature, or
    • (ii)
      the prevention [F11, investigation] or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.
(3) The [F12UK GDPR] provisions referred to in sub-paragraph (1) are the following provisions of the [F12UK GDPR] (the rights and obligations in which may be restricted by virtue of Article 23(1) of the [F12UK GDPR])—
  • (a)
    Article 13(1) to (3) (personal data collected from data subject: information to be provided);
  • (b)
    Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
  • (c)
    Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
  • (d)
    Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c).

Immigration

4
(1) The [F13relevant UK GDPR provisions] do not apply to personal data processed [F14by the Secretary of State] for any of the following purposes—
  • (a)
    the maintenance of effective immigration control, or
  • (b)
    the investigation or detection of activities that would undermine the maintenance of effective immigration control,

to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).

(1A) F15[F16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1B) F17 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1C) Paragraphs 4A and 4B make provision about F18... safeguards in connection with the exemption in [F19sub-paragraph (1)].]
(2) [F20In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions”] are the following provisions of the [F21UK GDPR] (the rights and obligations in which may be restricted by virtue of Article 23(1) of the [F21UK GDPR])—
  • (a)
    Article 13(1) to (3) (personal data collected from data subject: information to be provided);
  • (b)
    Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
  • (c)
    Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
  • (d)
    Article 17(1) and (2) (right to erasure);
  • (e)
    Article 18(1) (restriction of processing);
  • (f)
    Article 21(1) (objections to processing);
  • (g)
    Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).

(That is, the listed GDPR provisions other than Article 16 (right to rectification), Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing) and Article 20(1) and (2) (right to data portability) and, subject to sub-paragraph (2)(g) of this paragraph, the provisions of Article 5 listed in paragraph 1(b).)

(3) F22 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) F23 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F24Immigration: safeguards: immigration exemption decisions

4A.
(1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “an immigration exemption decision”) must be made in accordance with this paragraph.
(2) An immigration exemption decision must be made—
  • (a)
    on a case by case basis,
  • (b)
    separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and
  • (c)
    afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.
(3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—
  • (a)
    any potential vulnerability of the data subject that is relevant to the decision,
  • (b)
    all the rights and freedoms of the data subject including the data subject’s Convention rights, and
  • (c)
    any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—
    • (i)
      the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,
    • (ii)
      any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 (duty regarding the welfare of children), and
    • (iii)
      the need to ensure compliance with the UK GDPR.
(4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—
  • (a)
    the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),
  • (b)
    that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and
  • (c)
    the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.
(5) In this paragraph—
  • “Convention rights” has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);
  • “the Refugee Convention” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;
  • “the Trafficking Convention” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.]

[F24Immigration: safeguard: record of decision that exemption applies

4B.
(1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.
(2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).]

Information required to be disclosed by law etc or in connection with legal proceedings

5
(1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.
(2) The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.
(3) The listed GDPR provisions do not apply to personal data where disclosure of the data—
  • (a)
    is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),
  • (b)
    is necessary for the purpose of obtaining legal advice, or
  • (c)
    is otherwise necessary for the purposes of establishing, exercising or defending legal rights,

to the extent that the application of those provisions would prevent the controller from making the disclosure.

PART 2 Restrictions [F25as described in] Article 23(1): restrictions of rules in Articles 13 to 21 and 34

[F26UK GDPR] provisions to be restricted: “the listed GDPR provisions”

6 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the [F27UK GDPR] (the rights and obligations in which may be restricted by virtue of Article 23(1) of the [F27UK GDPR])—
  • (a)
    Article 13(1) to (3) (personal data collected from data subject: information to be provided);
  • (b)
    Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
  • (c)
    Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
  • (d)
    Article 16 (right to rectification);
  • (e)
    Article 17(1) and (2) (right to erasure);
  • (f)
    Article 18(1) (restriction of processing);
  • (g)
    Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
  • (h)
    Article 20(1) and (2) (right to data portability);
  • (i)
    Article 21(1) (objections to processing);
  • (j)
    Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).

Functions designed to protect the public etc

7 The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—
  • (a)
    is designed as described in column 1 of the Table, and
  • (b)
    meets the condition relating to the function specified in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

TABLE

Description of function design

Condition

1. The function is designed to protect members of the public against—

  • (a)
    financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate, or
  • (b)
    financial loss due to the conduct of discharged or undischarged bankrupts.

The function is—

  • (a)
    conferred on a person by an enactment,
  • (b)
    a function of the Crown, a Minister of the Crown or a government department, or
  • (c)
    of a public nature, and is exercised in the public interest.

2. The function is designed to protect members of the public against—

  • (a)
    dishonesty, malpractice or other seriously improper conduct, or
  • (b)
    unfitness or incompetence.

The function is—

  • (a)
    conferred on a person by an enactment,
  • (b)
    a function of the Crown, a Minister of the Crown or a government department, or
  • (c)
    of a public nature, and is exercised in the public interest.

3. The function is designed—

  • (a)
    to protect charities or community interest companies against misconduct or mismanagement (whether by trustees, directors or other persons) in their administration,
  • (b)
    to protect the property of charities or community interest companies from loss or misapplication, or
  • (c)
    to recover the property of charities or community interest companies.

The function is—

  • (a)
    conferred on a person by an enactment,
  • (b)
    a function of the Crown, a Minister of the Crown or a government department, or
  • (c)
    of a public nature, and is exercised in the public interest.

4. The function is designed—

  • (a)
    to secure the health, safety and welfare of persons at work, or
  • (b)
    to protect persons other than those at work against risk to health or safety arising out of or in connection with the action of persons at work.

The function is—

  • (a)
    conferred on a person by an enactment,
  • (b)
    a function of the Crown, a Minister of the Crown or a government department, or
  • (c)
    of a public nature, and is exercised in the public interest.

5. The function is designed to protect members of the public against—

  • (a)
    maladministration by public bodies,
  • (b)
    failures in services provided by public bodies, or
  • (c)
    a failure of a public body to provide a service which it is a function of the body to provide.

The function is conferred by any enactment on—

  • (a)
    the Parliamentary Commissioner for Administration,
  • (b)
    the Commissioner for Local Administration in England,
  • (c)
    the Health Service Commissioner for England,
  • (d)
    the Public Services Ombudsman for Wales,
  • (e)
    the Northern Ireland Public Services Ombudsman,
  • (f)
    the Prison Ombudsman for Northern Ireland, or
  • (g)
    the Scottish Public Services Ombudsman.

6. The function is designed—

  • (a)
    to protect members of the public against conduct which may adversely affect their interests by persons carrying on a business,
  • (b)
    to regulate agreements or conduct which have as their object or effect the prevention, restriction or distortion of competition in connection with any commercial activity, or
  • (c)
    to regulate conduct on the part of one or more undertakings which amounts to the abuse of a dominant position in a market.

The function is conferred on the Competition and Markets Authority by an enactment.

Audit functions

8
(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
(2) The functions are any function that is conferred by an enactment on—
  • (a)
    the Comptroller and Auditor General;
  • (b)
    the Auditor General for Scotland;
  • (c)
    the Auditor General for Wales;
  • (d)
    the Comptroller and Auditor General for Northern Ireland.

Functions of the Bank of England

9
(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
(2) “Relevant function of the Bank of England” means—

Regulatory functions relating to legal services, the health service and children's services

10
(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
(2) The functions are—

Regulatory functions of certain other persons

11 The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—
  • (a)
    is a function of a person described in column 1 of the Table, and
  • (b)
    is conferred on that person as described in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

TABLE

Person on whom function is conferred

How function is conferred

1. The [F29Commission] .

By or under—

  • (a)
    the data protection legislation;
  • (b)
    the Freedom of Information Act 2000;
  • (c)
    section 244 of the Investigatory Powers Act 2016;
  • (d)
    the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426);
  • (e)
    the Environmental Information Regulations 2004 (S.I. 2004/3391);
  • (f)
    the INSPIRE Regulations 2009 (S.I. 2009/3157);
  • (g)
    Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;
  • (h)
    the Re-use of Public Sector Information Regulations 2015 (S.I. 2015/1415);
  • (i)
    the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696).

2. The Scottish Information Commissioner.

By or under—

3. The Pensions Ombudsman.

By or under Part 10 of the Pension Schemes Act 1993 or any corresponding legislation having equivalent effect in Northern Ireland.

4. The Board of the Pension Protection Fund.

By or under sections 206 to 208 of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.

5. The Ombudsman for the Board of the Pension Protection Fund.

By or under any of sections 209 to 218 or 286(1) of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.

6. The Pensions Regulator.

By an enactment.

7. The Financial Conduct Authority.

By or under the Financial Services and Markets Act 2000 or by another enactment.

8. The Financial Ombudsman.

By or under Part 16 of the Financial Services and Markets Act 2000.

9. The investigator of complaints against the financial regulators.

By or under Part 6 of the Financial Services Act 2012.

F30. . .

F30. . .

11. The monitoring officer of a relevant authority.

By or under the Local Government and Housing Act 1989.

12. The monitoring officer of a relevant Welsh authority.

By or under the Local Government Act 2000.

13. The Public Services Ombudsman for Wales.

By or under the Local Government Act 2000.

14. The Charity Commission.

By or under—

12 In the Table in paragraph 11—

Parliamentary privilege

13 The listed GDPR provisions and Article 34(1) and (4) of the [F32UK GDPR] (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

Judicial appointments, judicial independence and judicial proceedings

14
(1) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for judicial office or the office of Queen's Counsel.
(2) The listed GDPR provisions do not apply to personal data processed by—
  • (a)
    an individual acting in a judicial capacity, or
  • (b)
    a court or tribunal acting in its judicial capacity.
(3) As regards personal data not falling within sub-paragraph (1) or (2), the listed GDPR provisions do not apply to the extent that the application of those provisions would be likely to prejudice judicial independence or judicial proceedings.

Crown honours, dignities and appointments

15
(1) The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.
(2) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for any of the following offices—
  • (a)
    archbishops and diocesan and suffragan bishops in the Church of England;
  • (b)
    deans of cathedrals of the Church of England;
  • (c)
    deans and canons of the two Royal Peculiars;
  • (d)
    the First and Second Church Estates Commissioners;
  • (e)
    lord-lieutenants;
  • (f)
    Masters of Trinity College and Churchill College, Cambridge;
  • (g)
    the Provost of Eton;
  • (h)
    the Poet Laureate;
  • (i)
    the Astronomer Royal.
(3) The Secretary of State may by regulations amend the list in sub-paragraph (2) to—
  • (a)
    remove an office, or
  • (b)
    add an office to which appointments are made by Her Majesty.
(4) Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.

PART 3 Restriction [F33for the] protection of rights of others

Protection of the rights of others: general

16
(1) Article 15(1) to (3) of the [F34UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the [F34UK GDPR] so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.
(2) Sub-paragraph (1) does not remove the controller's obligation where—
  • (a)
    the other individual has consented to the disclosure of the information to the data subject, or
  • (b)
    it is reasonable to disclose the information to the data subject without the consent of the other individual.
(3) In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—
  • (a)
    the type of information that would be disclosed,
  • (b)
    any duty of confidentiality owed to the other individual,
  • (c)
    any steps taken by the controller with a view to seeking the consent of the other individual,
  • (d)
    whether the other individual is capable of giving consent, and
  • (e)
    any express refusal of consent by the other individual.
(4) For the purposes of this paragraph—
  • (a)
    “information relating to another individual” includes information identifying the other individual as the source of information;
  • (b)
    an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—
    • (i)
      that information, or
    • (ii)
      that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.

Assumption of reasonableness for health workers, social workers and education workers

17
(1) For the purposes of paragraph 16(2)(b), it is to be considered reasonable for a controller to disclose information to a data subject without the consent of the other individual where—
  • (a)
    the health data test is met,
  • (b)
    the social work data test is met, or
  • (c)
    the education data test is met.
(2) The health data test is met if—
  • (a)
    the information in question is contained in a health record, and
  • (b)
    the other individual is a health professional who has compiled or contributed to the health record or who, in his or her capacity as a health professional, has been involved in the diagnosis, care or treatment of the data subject.
(3) The social work data test is met if—
  • (a)
    the other individual is—
    • (i)
      a children's court officer,
    • (ii)
      a person who is or has been employed by a person or body referred to in paragraph 8 of Schedule 3 in connection with functions exercised in relation to the information, or
    • (iii)
      a person who has provided for reward a service that is similar to a service provided in the exercise of any relevant social services functions, and
  • (b)
    the information relates to the other individual in an official capacity or the other individual supplied the information—
    • (i)
      in an official capacity, or
    • (ii)
      in a case within paragraph (a)(iii), in connection with providing the service mentioned in paragraph (a)(iii).
(4) The education data test is met if—
  • (a)
    the other individual is an education-related worker, or
  • (b)
    the other individual is employed by an education authority (within the meaning of the Education (Scotland) Act 1980) in pursuance of its functions relating to education and—
    • (i)
      the information relates to the other individual in his or her capacity as such an employee, or
    • (ii)
      the other individual supplied the information in his or her capacity as such an employee.
(5) In this paragraph—
  • “children's court officer” means a person referred to in paragraph 8(1)(q), (r), (s), (t) or (u) of Schedule 3;
  • “education-related worker” means a person referred to in paragraph 14(4)(a) or (b) or 16(4)(a), (b) or (c) of Schedule 3 (educational records);
  • “relevant social services functions” means functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3.

PART 4 Restrictions [F35as described in] Article 23(1): restrictions of rules in Articles 13 to 15

[F36UK GDPR] provisions to be restricted: “the listed GDPR provisions”

18 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the [F37UK GDPR] (the rights and obligations in which may be restricted by virtue of Article 23(1) of the [F37UK GDPR])—
  • (a)
    Article 13(1) to (3) (personal data collected from data subject: information to be provided);
  • (b)
    Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
  • (c)
    Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
  • (d)
    Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (c).

Legal professional privilege

19 The listed GDPR provisions do not apply to personal data that consists of—
  • (a)
    information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or
  • (b)
    information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

Self incrimination

20
(1) A person need not comply with the listed GDPR provisions to the extent that compliance would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.
(2) The reference to an offence in sub-paragraph (1) does not include an offence under—
(3) Information disclosed by any person in compliance with Article 15 of the [F38UK GDPR] is not admissible against the person in proceedings for an offence under this Act.

Corporate finance

21
(1) The listed GDPR provisions do not apply to personal data processed for the purposes of or in connection with a corporate finance service provided by a relevant person to the extent that either Condition A or Condition B is met.
(2) Condition A is that the application of the listed GDPR provisions would be likely to affect the price of an instrument.
(3) Condition B is that—
  • (a)
    the relevant person reasonably believes that the application of the listed GDPR provisions to the personal data in question could affect a decision of a person—
    • (i)
      whether to deal in, subscribe for or issue an instrument, or
    • (ii)
      whether to act in a way likely to have an effect on a business activity (such as an effect on the industrial strategy of a person, the capital structure of an undertaking or the legal or beneficial ownership of a business or asset), and
  • (b)
    the application of the listed GDPR provisions to that personal data would have a prejudicial effect on the orderly functioning of financial markets or the efficient allocation of capital within the economy.
(4) In this paragraph—
  • “corporate finance service” means a service consisting in—
    • (a)
      underwriting in respect of issues of, or the placing of issues of, any instrument,
    • (b)
      services relating to such underwriting, or
    • (c)
      advice to undertakings on capital structure, industrial strategy and related matters and advice and service relating to mergers and the purchase of undertakings;
  • “instrument” means an instrument listed in section C of Annex 1 to Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, and references to an instrument include an instrument not yet in existence but which is to be or may be created;
  • “price” includes value;
  • “relevant person” means—
    • (a)
      a person who, by reason of a permission under Part 4A of the Financial Services and Markets Act 2000, is able to carry on a corporate finance service without contravening the general prohibition;
    • (b)
      an EEA firm of the kind mentioned in paragraph 5(a) or (b) of Schedule 3 to that Act which has qualified for authorisation under paragraph 12 of that Schedule, and may lawfully carry on a corporate finance service;
    • (c)
      a person who is exempt from the general prohibition in respect of any corporate finance service—
      • (i)
        as a result of an exemption order made under section 38(1) of that Act, or
      • (ii)
        by reason of section 39(1) of that Act (appointed representatives);
    • (d)
      a person, not falling within paragraph (a), (b) or (c), who may lawfully carry on a corporate finance service without contravening the general prohibition;
    • (e)
      a person who, in the course of employment, provides to their employer a service falling within paragraph (b) or (c) of the definition of “corporate finance service”;
    • (f)
      a partner who provides to other partners in the partnership a service falling within either of those paragraphs.
(5) In the definition of “relevant person” in sub-paragraph (4), references to “the general prohibition” are to the general prohibition within the meaning of section 19 of the Financial Services and Markets Act 2000.

Management forecasts

22 The listed GDPR provisions do not apply to personal data processed for the purposes of management forecasting or management planning in relation to a business or other activity to the extent that the application of those provisions would be likely to prejudice the conduct of the business or activity concerned.

Negotiations

23 The listed GDPR provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of those provisions would be likely to prejudice those negotiations.

Confidential references

24 The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of—
  • (a)
    the education, training or employment (or prospective education, training or employment) of the data subject,
  • (b)
    the placement (or prospective placement) of the data subject as a volunteer,
  • (c)
    the appointment (or prospective appointment) of the data subject to any office, or
  • (d)
    the provision (or prospective provision) by the data subject of any service.

Exam scripts and exam marks

25
(1) The listed GDPR provisions do not apply to personal data consisting of information recorded by candidates during an exam.
(2) Where personal data consists of marks or other information processed by a controller—
  • (a)
    for the purposes of determining the results of an exam, or
  • (b)
    in consequence of the determination of the results of an exam,

the duty in Article 12(3) or (4) of the [F39UK GDPR] for the controller to provide information requested by the data subject within a certain time period, as it applies to Article 15 of the [F39UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers), is modified as set out in sub-paragraph (3).

(3) Where a question arises as to whether the controller is obliged by Article 15 of the [F40UK GDPR] to disclose personal data, and the question arises before the day on which the exam results are announced, the controller must provide the information mentioned in Article 12(3) or (4)—
  • (a)
    before the end of the period of 5 months beginning when the question arises, or
  • (b)
    if earlier, before the end of the period of 40 days beginning with the announcement of the results.
(4) In this paragraph, “exam” means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity.
(5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.

PART 5 Exemptions etc F41... for reasons of freedom of expression and information

Journalistic, academic, artistic and literary purposes

26
(1) In this paragraph, “the special purposes” means one or more of the following—
  • (a)
    the purposes of journalism;
  • (b)
    academic purposes;
  • (c)
    artistic purposes;
  • (d)
    literary purposes.
(2) Sub-paragraph (3) applies to the processing of personal data carried out for the special purposes if—
  • (a)
    the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and
  • (b)
    the controller reasonably believes that the publication of the material would be in the public interest.
(3) The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.
(4) In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.
(5) In determining whether it is reasonable to believe that publication would be in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (6) that is relevant to the publication in question.
(6) The codes of practice and guidelines are—
  • (a)
    BBC Editorial Guidelines;
  • (b)
    Ofcom Broadcasting Code;
  • (c)
    Editors' Code of Practice.
(7) The Secretary of State may by regulations amend the list in sub-paragraph (6).
(8) Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.
(9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the [F42UK GDPR] (which may be exempted or derogated from by virtue of Article 85(2) of the [F42UK GDPR])—
  • (a)
    in Chapter II of the [F43UK GDPR] (principles)—
    • (i)
      Article 5(1)(a) to (e) (principles relating to processing);
    • (ii)
      Article 6 (lawfulness);
    • (iii)
      Article 7 (conditions for consent);
    • (iv)
      Article 8(1) and (2) (child's consent);
    • (v)
      Article 9 (processing of special categories of data);
    • (vi)
      Article 10 (data relating to criminal convictions etc);
    • (vii)
      Article 11(2) (processing not requiring identification);
  • (b)
    in Chapter III of the [F44UK GDPR] (rights of the data subject)—
    • (i)
      Article 13(1) to (3) (personal data collected from data subject: information to be provided);
    • (ii)
      Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
    • (iii)
      Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
    • (iv)
      Article 16 (right to rectification);
    • (v)
      Article 17(1) and (2) (right to erasure);
    • (vi)
      Article 18(1)(a), (b) and (d) (restriction of processing);
    • (vii)
      Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
    • (viii)
      Article 20(1) and (2) (right to data portability);
    • (ix)
      Article 21(1) (objections to processing);
  • (c)
    in Chapter IV of the [F45UK GDPR] (controller and processor)—
    • (i)
      Article 34(1) and (4) (communication of personal data breach to the data subject);
    • (ii)
      Article 36 (requirement for controller to consult [F46Commission] prior to high risk processing);
  • (d)
    in Chapter V of the [F47UK GDPR] (transfers of data to third countries etc), Article [F4844A] (general principles for transfers);
  • (e)
    F49 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 6 Derogations etc F50... for research, statistics and archiving

Research and statistics

27
(1) The listed GDPR provisions do not apply to personal data processed for—
  • (a)
    scientific or historical research purposes, or
  • (b)
    statistical purposes,

to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.

This is subject to [F51sub-paragraphs (3) and (4)].

(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the [F52UK GDPR]—
  • (a)
    Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
  • (b)
    Article 16 (right to rectification);
  • (c)
    Article 18(1) (restriction of processing);
  • (d)
    Article 21(1) (objections to processing).
(3) The exemption in sub-paragraph (1) is available only where—
  • (a)
    the personal data is processed in accordance with [F53Article 84B of the UK GDPR], and
  • (b)
    as regards the disapplication of Article 15(1) to (3), the results of the research or any resulting statistics are not made available in a form which identifies a data subject.
(4) [F54 Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.]

Archiving in the public interest

28
(1) The listed GDPR provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.

This is subject to [F55sub-paragraphs (3) and (4)].

(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the [F56UK GDPR]—
  • (a)
    Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
  • (b)
    Article 16 (right to rectification);
  • (c)
    Article 18(1) (restriction of processing);
  • (d)
    Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
  • (e)
    Article 20(1) (right to data portability);
  • (f)
    Article 21(1) (objections to processing).
(3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with [F57Article 84B of the UK GDPR].
(4) [F58 Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.]

Amended text

This Schedule is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Words in Sch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 Words in Sch. 2 Pt. 1 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F3 Words in Sch. 2 para. 1 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Words in Sch. 2 para. 1(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F5 Words in Sch. 2 para. 1(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Sch. 2 para. 1(b)(ii) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 71(10), 142(1); S.I. 2026/82, reg. 2(d)
  7. F7 Words in Sch. 2 para. 2(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Word in Sch. 2 para. 2(1)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 29(2); S.I. 2026/82, reg. 2(z12)
  9. F9 Words in Sch. 2 para. 2(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  10. F10 Words in Sch. 2 para. 3(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  11. F11 Word in Sch. 2 para. 3(2)(b)(ii) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 29(3); S.I. 2026/82, reg. 2(z12)
  12. F12 Words in Sch. 2 para. 3(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  13. F13 Words in Sch. 2 para. 4(1) substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(2)
  14. F14 Words in Sch. 2 para. 4(1) inserted (31.1.2022) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(a)
  15. F15 Sch. 2 para. 4(1A) omitted (8.3.2024) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(3)
  16. F16 Sch. 2 para. 4(1A)-(1C) inserted (31.1.2022) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(b)
  17. F17 Sch. 2 para. 4(1B) omitted (8.3.2024) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(3)
  18. F18 Word in Sch. 2 para. 4(1C) omitted (8.3.2024) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(4)(a)
  19. F19 Words in Sch. 2 para. 4(1C) substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(4)(b)
  20. F20 Words in Sch. 2 para. 4(2) substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(5)
  21. F21 Words in Sch. 2 para. 4(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(8)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  22. F22 Sch. 2 para. 4(3) omitted (31.1.2022) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(d)
  23. F23 Sch. 2 para. 4(4) omitted (31.1.2022) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(d)
  24. F24 Sch. 2 paras. 4A, 4B and cross-headings substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 3
  25. F25 Words in Sch. 2 Pt. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(9) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  26. F26 Words in Sch. 2 para. 6 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(10) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  27. F27 Words in Sch. 2 para. 6 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(11) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  28. F28 Words in Sch. 2 para. 10(2)(c)(iv) inserted (E.W.) (23.7.2019) by Public Services Ombudsman (Wales) Act 2019 (anaw 3), s. 77(1), Sch. 5 para. 28; S.I. 2019/1096, reg. 2
  29. F29 Word in Sch. 2 para. 11 Table substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  30. F30 Words in Sch. 2 para. 11 table omitted (31.12.2020) by virtue of The Consumer Protection (Enforcement) (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/203), regs. 1, 5(a); 2020 c. 1, Sch. 5 para. 1(1)
  31. F31 Words in Sch. 2 para. 12 omitted (31.12.2020) by virtue of The Consumer Protection (Enforcement) (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/203), regs. 1, 5(b); 2020 c. 1, Sch. 5 para. 1(1)
  32. F32 Words in Sch. 2 para. 13 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(12) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  33. F33 Words in Sch. 2 Pt. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(13) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  34. F34 Words in Sch. 2 para. 16(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(14) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  35. F35 Words in Sch. 2 Pt. 4 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(15) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  36. F36 Words in Sch. 2 para. 18 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(16) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  37. F37 Words in Sch. 2 para. 18 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(17) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  38. F38 Words in Sch. 2 para. 20(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(18) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  39. F39 Words in Sch. 2 para. 25(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(19)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  40. F40 Words in Sch. 2 para. 25(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(19)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  41. F41 Words in Sch. 2 Pt. 5 heading omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(20) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  42. F42 Words in Sch. 2 para. 26(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  43. F43 Words in Sch. 2 para. 26(9)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  44. F44 Words in Sch. 2 para. 26(9)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  45. F45 Words in Sch. 2 para. 26(9)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  46. F46 Word in Sch. 2 para. 26(9)(c)(ii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  47. F47 Words in Sch. 2 para. 26(9)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  48. F48 Word in Sch. 2 para. 26(9)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 24 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  49. F49 Sch. 2 para. 26(9)(e) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  50. F50 Words in Sch. 2 Pt. 6 heading omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(22) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  51. F51 Words in Sch. 2 para. 27(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(23)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  52. F52 Words in Sch. 2 para. 27(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(23)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  53. F53 Words in Sch. 2 para. 27(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 87(2)(c)(i), 142(1); S.I. 2026/82, reg. 2(o)
  54. F54 Sch. 2 para. 27(4) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(23)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  55. F55 Words in Sch. 2 para. 28(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(24)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  56. F56 Words in Sch. 2 para. 28(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(24)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  57. F57 Words in Sch. 2 para. 28(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 87(2)(c)(ii), 142(1); S.I. 2026/82, reg. 2(o)
  58. F58 Sch. 2 para. 28(4) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(24)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Modifications etc. (not altering text)

  1. C1 Sch. 2 para. 7 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 238 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))
  2. C2 Sch. 2 para. 7 modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 237 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))
  3. C3 Sch. 2 para. 7 modified by S.I. 2007/1118, art. 5(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 324 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))
  4. C4 Sch. 2 para. 11 table modified (28.1.2021 for specified purposes, 30.7.2022 in so far as not already in force) by The Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2021 (S.I. 2021/90), arts. 1(2)(3), 15(2)

Commencement Information

  1. I1 Sch. 2 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  2. I2 Sch. 2 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  3. I3 Sch. 2 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  4. I4 Sch. 2 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  5. I5 Sch. 2 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  6. I6 Sch. 2 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  7. I7 Sch. 2 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  8. I8 Sch. 2 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  9. I9 Sch. 2 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  10. I10 Sch. 2 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  11. I11 Sch. 2 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  12. I12 Sch. 2 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  13. I13 Sch. 2 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  14. I14 Sch. 2 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  15. I15 Sch. 2 para. 15 in force at Royal Assent for specified purposes, see s. 212(2)(f)
  16. I16 Sch. 2 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  17. I17 Sch. 2 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  18. I18 Sch. 2 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  19. I19 Sch. 2 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  20. I20 Sch. 2 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  21. I21 Sch. 2 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  22. I22 Sch. 2 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  23. I23 Sch. 2 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  24. I24 Sch. 2 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  25. I25 Sch. 2 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  26. I26 Sch. 2 para. 26 in force at Royal Assent for specified purposes, see s. 212(2)(f)
  27. I27 Sch. 2 para. 26 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)
  28. I28 Sch. 2 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)
  29. I29 Sch. 2 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Referred to in

s. 15s. 16s. 182s. 186

https://dpa2018.digiphile.law/schedule/schedule-2.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.