Legislation – Data Protection Act 2018

Data Protection Act 2018, Cross Heading: Exemptions etc is up to date with all changes known to be in force on or before 04 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

PART 2General processing

F1Exemptions etc

15Exemptions etc

(1)

Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the F2UK GDPR.

(2)

In Schedule 2—

(a)

Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the F3UK GDPR in specified circumstances F4(of a kind described in Article 6(3) and Article 23(1) of the F5UK GDPR);

(b)

Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the F6UK GDPR in specified circumstances F7(of a kind described in Article 23(1) of the F8UK GDPR);

(c)

Part 3 makes provision restricting the application of Article 15 of the F9UK GDPR where this is necessary to protect the rights of others F10(of a kind described in Article 23(1) of the F11UK GDPR);

(d)

Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the F12UK GDPR in specified circumstances F13(of a kind described in Article 23(1) of the F14UK GDPR);

(e)

Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV F15and V of the UK GDPR for reasons relating to freedom of expression F16(of a kind described in Article 85(2) of the UK GDPR);

(f)

Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the F17UK GDPR for scientific or historical research purposes, statistical purposes and archiving purposes F18….

(3)

Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the F19UK GDPR to health, social work, education and child abuse data F20(of a kind described in Article 23(1) of the F21UK GDPR).

(4)

Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the F22UK GDPR to information the disclosure of which is prohibited or restricted by an enactment F23(of a kind described in Article 23(1) of the F24UK GDPR).

F25(4A)

In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).

(5)

In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part F26(sections 26 to 28).

16Power to make further exemptions etc by regulations

(1)

The following powers to make provision altering the application of the F27UK GDPR may be exercised by way of regulations made by the Secretary of State under this section—

(a)

the power in Article 6(3) F28… to lay down a legal basis containing specific provisions to adapt the application of rules of the F29UK GDPR where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;

(b)

the power in Article 23(1) to make F30provision restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;

(c)

the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the F31UK GDPR where necessary to reconcile the protection of personal data with the freedom of expression and information.

(2)

Regulations under this section may—

(a)

amend Schedules 2 to 4—

(i)

by adding or varying provisions, and

(ii)

by omitting provisions added by regulations under this section, F32…

(b)

consequentially amend section 15 F33, and

(c)

consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.

(3)

Regulations under this section are subject to the affirmative resolution procedure.