Exemptions

Trigger. Processing is lawful under Art 6(1)(ea) only if it is necessary for a condition listed in Annex 1, such as national security, emergencies, crime prevention or safeguarding. No balancing test. Not available to public authorities for processing in performance of their tasks.

Disapplies. Art 6(1)(f) balancing test, for listed purposes.

Trigger. Further processing for a purpose listed in Annex 2 is treated as compatible with the original purpose, so no compatibility assessment is needed for those purposes.

Disapplies. Purpose limitation compatibility assessment, for listed purposes.

Trigger. The data subject is entitled only to what the controller can provide based on a reasonable and proportionate search. Treated as in force from 2024-01-01.

Disapplies. Unlimited search for subject access.

Trigger. Applies where exemption from a provision is required for the purpose of safeguarding national security or for defence purposes. A Minister of the Crown can certify that exemption is required for national security; the certificate is conclusive evidence of that, subject to challenge before the Upper Tribunal on judicial review principles (s.27).

Disapplies. The principles (except lawfulness), the rights in Chapter III, breach notification, the regulator's inspection and enforcement powers and the transfer rules, to the extent required.

Narrow in practice: "required" is a higher bar than "likely to prejudice". The DUAA 2025 (s.88) added an equivalent national security exemption for law enforcement processing under Part 3.

Trigger. Applies only to the extent that applying the provisions would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. A prejudice test applied case by case, not an automatic exemption for anyone processing crime-adjacent data. A second controller that receives the data for its statutory functions can rely on it on the same test.

Disapplies. Transparency (Arts 13 and 14), access (Art 15) and the other rights in Arts 16 to 21, with the Art 5 principles so far as they correspond.

Trigger. A classification applied to a data subject under a risk assessment system operated by a government department, local authority or housing benefit authority for crime or tax purposes, to the extent that applying the provisions would prevent the system operating effectively.

Disapplies. Transparency and access in relation to the classification.

Trigger. Applies where applying the provisions would be likely to prejudice the maintenance of effective immigration control, or the investigation or detection of activities that would undermine it. Since 2024-03-08 the safeguards are in the Act itself (paras 4A and 4B): each decision is made case by case, separately for each right and afresh each time; the Secretary of State must weigh the person's vulnerability, their rights including Convention rights, and the UK's international and child welfare obligations; the exemption applies only where there is a substantial risk of prejudice that outweighs the harm to the person and is necessary and proportionate; and each use must be recorded with reasons and, unless that would itself prejudice immigration control, the person told.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), erasure (Art 17), restriction (Art 18) and objection (Art 21), with the Art 5 principles so far as they correspond.

The most litigated exemption in the Act. The Court of Appeal held the original version unlawful in 2021 for lacking safeguards, and held the 2022 policy-document fix unlawful in 2023 because the safeguards had to be in legislation. The 2024 Regulations moved them into the Act.

Trigger. Applies where disclosure is required by an enactment, a rule of law or a court or tribunal order, or is necessary for legal proceedings (including prospective proceedings), obtaining legal advice, or establishing, exercising or defending legal rights, to the extent that applying the provisions would prevent the controller making the disclosure.

Disapplies. The listed provisions, to the extent they would prevent the disclosure.

Trigger. Processing for functions listed in the Schedule's table, such as protecting the public against financial loss from dishonesty or malpractice, protecting charities, securing health and safety at work, and protecting the public against maladministration, where the function is conferred by enactment, is a Crown, ministerial or government department function, or is of a public nature exercised in the public interest. Applies to the extent that applying the provisions would be likely to prejudice the proper discharge of the function.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. Functions conferred by enactment on the Comptroller and Auditor General, the Auditor General for Scotland, the Auditor General for Wales or the Comptroller and Auditor General for Northern Ireland, to the extent that applying the provisions would be likely to prejudice the proper discharge of the function.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. The Bank's functions as a monetary authority, its functions of a public nature, and its functions as the Prudential Regulation Authority, to the extent that applying the provisions would be likely to prejudice their proper discharge.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. Listed functions of bodies such as the Legal Services Board, the bodies handling complaints about legal services, the health service complaints and ombudsman bodies, and the children's commissioners, to the extent that applying the provisions would be likely to prejudice their proper discharge.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. Functions of the regulators and ombudsmen listed in the Schedule's table, conferred by the enactments listed there, to the extent that applying the provisions would be likely to prejudice their proper discharge.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. Applies where exemption is required to avoid an infringement of the privileges of either House of Parliament.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. Processing to assess a person's suitability for judicial office or the office of King's Counsel, and processing by an individual acting in a judicial capacity or a court or tribunal acting judicially. Otherwise applies to the extent that applying the provisions would be likely to prejudice judicial independence or judicial proceedings.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. Processing to confer a Crown honour or dignity, or to assess a person's suitability for one of the offices listed, which the Secretary of State can amend by regulations.

Disapplies. Transparency (Arts 13 and 14), access (Art 15), the rights in Arts 16 to 21, telling people about a breach (Art 34), and the Art 5 principles so far as they correspond.

Trigger. A controller need not comply with a subject access request to the extent that doing so would disclose information about another identifiable individual, unless that person has consented or it is reasonable to disclose without consent. Reasonableness takes account of any duty of confidentiality, the steps taken to seek consent, whether the other person can consent, and any express refusal. Disclosure without consent is treated as reasonable for health workers, social workers and education workers named in the records (para 17).

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

The exemption most often engaged in practice. It permits redaction, not refusal of the whole request.

Trigger. Information in respect of which a claim to legal professional privilege, or in Scotland confidentiality of communications, could be maintained in legal proceedings, or which is subject to a duty of confidentiality owed by a professional legal adviser to a client.

Disapplies. Transparency (Arts 13 and 14) and access (Art 15), with the Art 5 principles so far as they correspond.

A class exemption with no prejudice test. The DUAA 2025 (s.79) added an equivalent exemption for law enforcement processing under Part 3.

Trigger. A person need not comply to the extent that compliance would reveal evidence of the commission of an offence and expose them to proceedings for it. It does not cover offences under the DPA 2018 itself or perjury-type offences, and information disclosed in response to a subject access request is not admissible against the person in proceedings for a DPA 2018 offence.

Disapplies. Transparency (Arts 13 and 14) and access (Art 15), with the Art 5 principles so far as they correspond.

Trigger. Processing for a corporate finance service provided by a relevant person, to the extent that applying the provisions would be likely to affect the price of an instrument, or where it could affect a person's decisions on an instrument or business and would have a prejudicial effect on the orderly functioning of financial markets or the efficient allocation of capital in the economy.

Disapplies. Transparency (Arts 13 and 14) and access (Art 15), with the Art 5 principles so far as they correspond.

Trigger. Processing for management forecasting or management planning about a business or other activity, to the extent that applying the provisions would be likely to prejudice the conduct of that business or activity.

Disapplies. Transparency (Arts 13 and 14) and access (Art 15), with the Art 5 principles so far as they correspond.

Trigger. Records of the controller's intentions in negotiations with the data subject, to the extent that applying the provisions would be likely to prejudice those negotiations.

Disapplies. Transparency (Arts 13 and 14) and access (Art 15), with the Art 5 principles so far as they correspond.

Trigger. References given, or to be given, in confidence for the education, training or employment of the data subject, a volunteer placement, an appointment to office, or the provision of a service by the data subject. No prejudice test: the confidence is enough.

Disapplies. Transparency (Arts 13 and 14) and access (Art 15), with the Art 5 principles so far as they correspond.

Covers the reference in the hands of the giver and of the recipient.

Trigger. Information recorded by candidates during an exam is exempt from access. For exam marks, the time to respond to an access request made before results are announced is extended to the earlier of five months from the request or 40 days after the results are announced.

Disapplies. Access (Art 15) for exam scripts; the response time for marks.

Trigger. Processing with a view to publication of journalistic, academic, artistic or literary material, where the controller reasonably believes publication would be in the public interest and reasonably believes that applying a provision would be incompatible with the special purposes. In judging the public interest the controller must have regard to the relevant codes, including the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors' Code of Practice, and the regulator's journalism code under s.124.

Disapplies. Most of the UK GDPR: the principles other than security, lawful basis and consent conditions, special category conditions, the rights in Arts 13 to 21, breach notice to individuals, prior consultation and the transfer rules, to the extent incompatible with the special purposes.

The widest exemption in the Schedule, matched by the s.124 journalism code in force since 2024-02-22.

Trigger. Processing for scientific or historical research or statistical purposes, to the extent that applying the provisions would prevent or seriously impair those purposes. The Art 89(1) safeguards must be in place, and for the access right the results must not be made available in a form that identifies data subjects.

Disapplies. Access (Art 15), rectification (Art 16), restriction (Art 18) and objection (Art 21).

Trigger. Processing for archiving purposes in the public interest, to the extent that applying the provisions would prevent or seriously impair those purposes, with the Art 89(1) safeguards in place.

Disapplies. Access (Art 15), rectification (Art 16), restriction (Art 18), notification to recipients (Art 19), portability (Art 20) and objection (Art 21).

Trigger. Health data in a report or other evidence given to a court in specified proceedings (for example children's and family proceedings) which the court may withhold from the data subject under the applicable rules in England and Wales, Scotland or Northern Ireland.

Disapplies. Transparency (Arts 13 and 14), access (Art 15) and the rights in Arts 16 to 21, with the Art 5 principles so far as they correspond.

Trigger. A request made under an enactment or rule of law by a person with parental responsibility for a child (under 18 in England, Wales and Northern Ireland; under 16 in Scotland) or by a court-appointed manager, for health data that the data subject provided in the expectation it would not be disclosed to the requester, or that the data subject has asked not to be disclosed.

Disapplies. Transparency (Arts 13 and 14), access (Art 15) and the rights in Arts 16 to 21, with the Art 5 principles so far as they correspond.

Trigger. Access is disapplied to the extent that complying would be likely to cause serious harm to the physical or mental health of the data subject or another individual. A controller that is not a health professional may rely on it only with a recent opinion from the appropriate health professional that the serious harm test is met.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Trigger. A restriction, not an exemption: a controller that is not a health professional must not disclose health data in response to an access request without first obtaining an opinion from the appropriate health professional that the serious harm test is not met, unless the data subject has already seen or knows about the information.

Disapplies. Restricts disclosure under Art 15 until the opinion is obtained.

Trigger. Social work data in a report or evidence given to a court in specified proceedings that the court may withhold from the data subject under the applicable rules.

Disapplies. Transparency (Arts 13 and 14), access (Art 15) and the rights in Arts 16 to 21, with the Art 5 principles so far as they correspond.

Trigger. The same structure as the health data rule: a request by a person with parental responsibility or a court-appointed manager, for social work data provided in the expectation of non-disclosure to the requester or which the data subject has asked to be withheld.

Disapplies. Transparency (Arts 13 and 14), access (Art 15) and the rights in Arts 16 to 21, with the Art 5 principles so far as they correspond.

Trigger. Access is disapplied to the extent that complying would be likely to prejudice the carrying out of social work because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Trigger. A restriction for Scottish social work authorities: where data came from the Principal Reporter for children's hearings, the authority must tell the Reporter within 14 days of the request and may not disclose unless the Reporter gives the opinion that the serious harm test is not met.

Disapplies. Restricts disclosure under Art 15 until the opinion is given.

Extent Scotland only.

Trigger. Education data in a report or evidence given to a court in specified proceedings that the court may withhold from the data subject under the applicable rules.

Disapplies. Transparency (Arts 13 and 14), access (Art 15) and the rights in Arts 16 to 21, with the Art 5 principles so far as they correspond.

Trigger. Access is disapplied to the extent that complying would be likely to cause serious harm to the physical or mental health of the data subject or another individual. Education data means educational records held by schools in England and Wales and Northern Ireland, and records processed by Scottish education authorities.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Trigger. A restriction for Scottish education authorities: where the authority believes data came from the Principal Reporter, it may not disclose in response to an access request unless the Reporter gives the opinion that the serious harm test is not met.

Disapplies. Restricts disclosure under Art 15 until the opinion is given.

Extent Scotland only.

Trigger. A request made under an enactment or rule of law by a person with parental responsibility for a child under 18, or by a court-appointed manager, for data about physical injury to, or physical or emotional neglect, ill-treatment or sexual abuse of, the data subject. Access is disapplied to the extent that complying would not be in the best interests of the data subject.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Extent England, Wales and Northern Ireland only. The exemption cannot apply in Scotland, which makes it the clearest territorial asymmetry in the Act.

Trigger. Personal data whose disclosure is prohibited or restricted by sections 31, 31ZA to 31ZE and 33A to 33D of the Human Fertilisation and Embryology Act 1990.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Trigger. Personal data whose disclosure is prohibited or restricted by the adoption enactments listed for England and Wales, Scotland and Northern Ireland, such as the Adoption Agencies Regulations and the court rules on adoption proceedings.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

The enactments differ by nation; the exemption follows whichever restriction applies.

Trigger. Personal data whose disclosure is restricted by the special educational needs and additional support for learning rules in England, Scotland and Northern Ireland.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Trigger. Personal data whose disclosure is restricted by the enactments governing parental orders after surrogacy, as applied by the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 in each nation.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Trigger. Personal data whose disclosure is restricted by s.178 of the Children's Hearings (Scotland) Act 2011 or the children's hearings procedure rules.

Disapplies. Access (Art 15(1) to (3)), with the Art 5 principles so far as they correspond.

Extent Scotland only.

Trigger. The authority does not hold the information when the request is received.

Trigger. The request is manifestly unreasonable, for example vexatious or grossly burdensome to comply with. Subject to the public interest test.

Trigger. The request is too general and the authority has given advice and assistance to clarify it. Subject to the public interest test.

Trigger. A class-type exception for unfinished material. Subject to the public interest test.

Trigger. Communications within the authority. Subject to the public interest test.

Trigger. Disclosure would adversely affect one of these interests. Subject to the public interest test.

Trigger. Disclosure would adversely affect the course of justice, a fair trial, or a criminal or disciplinary inquiry. Subject to the public interest test.

Trigger. Disclosure would adversely affect intellectual property rights. Subject to the public interest test.

Trigger. Disclosure would adversely affect the confidentiality of the proceedings of a public authority where that confidentiality is provided by law. Not available for information on emissions.

Trigger. Disclosure would adversely affect the confidentiality of commercial or industrial information where provided by law to protect a legitimate economic interest. Not available for information on emissions.

Trigger. Disclosure would adversely affect the interests of a person who supplied the information voluntarily, was not obliged to and has not consented. Not available for information on emissions.

Trigger. Disclosure would adversely affect the protection of the environment to which the information relates, for example the location of rare species. Not available for information on emissions.

Trigger. Disclosure would contravene the data protection principles, or certain data subject rights conditions apply. The applicant's own personal data is handled as subject access.

The first condition is absolute; others are subject to the public interest test.

Trigger. The authority does not hold the information when the request is received.

Trigger. The request is manifestly unreasonable, for example vexatious or grossly burdensome to comply with. Subject to the public interest test.

Trigger. The request is too general and the authority has given advice and assistance to clarify it. Subject to the public interest test.

Trigger. A class-type exception for unfinished material. Subject to the public interest test.

Trigger. Communications within the authority. Subject to the public interest test.

Trigger. Disclosure would adversely affect one of these interests. Subject to the public interest test.

Trigger. Disclosure would adversely affect the course of justice, a fair trial, or a criminal or disciplinary inquiry. Subject to the public interest test.

Trigger. Disclosure would adversely affect intellectual property rights. Subject to the public interest test.

Trigger. Disclosure would adversely affect the confidentiality of the proceedings of a public authority where that confidentiality is provided by law. Not available for information on emissions.

Trigger. Disclosure would adversely affect the confidentiality of commercial or industrial information where provided by law to protect a legitimate economic interest. Not available for information on emissions.

Trigger. Disclosure would adversely affect the interests of a person who supplied the information voluntarily, was not obliged to and has not consented. Not available for information on emissions.

Trigger. Disclosure would adversely affect the protection of the environment to which the information relates, for example the location of rare species. Not available for information on emissions.

Trigger. Disclosure would contravene the data protection principles, or certain data subject rights conditions apply. The applicant's own personal data is handled as subject access.

The first condition is absolute; others are subject to the public interest test.

Trigger. Absolute. The applicant can reasonably obtain the information other than by requesting it.

Trigger. Absolute. Disclosure is prohibited by an enactment, incompatible with a Community obligation preserved in law, or would be contempt of court.

Trigger. Subject to the public interest test. Held with a view to publication within 12 weeks of the request, and reasonable to withhold until then; also covers ongoing research programmes.

Trigger. Subject to the public interest test. Disclosure would, or would be likely to, prejudice substantially relations between administrations in the UK.

Trigger. Subject to the public interest test, class-based. Information held by the Scottish Administration relating to policy formulation, ministerial communications, Law Officers' advice or a ministerial private office.

Trigger. Subject to the public interest test. Disclosure would, or would be likely to, prejudice substantially the free and frank provision of advice or exchange of views, or the effective conduct of public affairs.

Trigger. Subject to the public interest test. Required for safeguarding national security, or disclosure would prejudice substantially defence.

Trigger. Subject to the public interest test. Disclosure would prejudice substantially international relations, or confidential information from another State or international organisation.

Trigger. Subject to the public interest test. Trade secrets, or disclosure would prejudice substantially commercial interests or the economic interests of the UK or the Scottish Administration.

Trigger. Subject to the public interest test, class-based. Information held for criminal investigations and proceedings, and certain other investigations.

Trigger. Subject to the public interest test. Disclosure would prejudice substantially the prevention or detection of crime, the administration of justice or other listed functions.

Trigger. Subject to the public interest test. Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings.

Trigger. Absolute. The information was obtained from another person and disclosure would constitute an actionable breach of confidence.

Trigger. Absolute. Information held only by virtue of documents filed with, or created by, a court or tribunal for proceedings.

Trigger. Absolute for the applicant's own personal data and for third-party data where disclosure would contravene the data protection principles; other limbs subject to conditions.

The applicant's own data is handled as subject access under UK-wide data protection law.

Trigger. Subject to the public interest test. Disclosure would, or would be likely to, endanger health or safety; s.39(2) routes environmental information to the EIRS.

Trigger. Subject to the public interest test. Disclosure would prejudice substantially an audit function.

Trigger. Subject to the public interest test. Communications with the Royal Family and Household, and honours.

Trigger. Not an exemption: a ground for refusal where the cost of complying exceeds the prescribed amount. Advice and assistance should be offered (s.15).

Trigger. Not an exemption: a ground for refusal where the request is vexatious or repeats a recent identical or substantially similar request.

Trigger. Absolute. Applies where the information is reasonably accessible to the applicant otherwise than under the Act, for example already published.

Disapplies. s.1(1)(b) duty to communicate.

Trigger. Qualified, class-based. The information is held with a view to publication at a future date, and it is reasonable in all the circumstances to withhold it until then.

Disapplies. s.1(1)(b).

Trigger. Qualified, prejudice-based. Information obtained in a continuing programme of research intended for publication, where disclosure before then would, or would be likely to, prejudice the programme, the researcher's interests or the authority's interests.

Disapplies. s.1(1)(b).

Trigger. Absolute, class-based. Information directly or indirectly supplied by, or relating to, the bodies listed in s.23(3), such as the security and intelligence agencies.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified. Applies where exemption is required for the purpose of safeguarding national security. A Minister's certificate is conclusive evidence, subject to appeal.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the defence of the British Islands or the capability or security of the armed forces.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, prejudice-based, or class-based for confidential information obtained from another State or an international organisation.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice relations between administrations in the UK.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the economic interests of the UK or the financial interests of a UK administration.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, class-based. Information held for criminal investigations or proceedings, or obtained from confidential sources for certain investigations.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the prevention or detection of crime, the administration of justice, tax collection or other listed functions. Only where s.30 does not apply.

Disapplies. s.1(1)(a) and (b).

Trigger. Absolute, class-based. Information held only by virtue of being in documents filed with, or created by, a court or tribunal for proceedings.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, prejudice-based. Applies to authorities with audit functions where disclosure would, or would be likely to, prejudice those functions.

Disapplies. s.1(1)(a) and (b).

Trigger. Absolute. Exemption is required to avoid an infringement of the privileges of either House. A certificate from the Speaker or Clerk is conclusive.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, class-based. Information held by a government department relating to the formulation or development of government policy, ministerial communications, Law Officers' advice or a ministerial private office.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, except for information held by either House of Parliament. Engaged only where, in the reasonable opinion of a qualified person, disclosure would, or would be likely to, prejudice the matters listed. The opinion must be reasonable and actually given.

Disapplies. s.1(1)(a) and (b).

Trigger. Absolute for communications with the Sovereign, the heir and the second in line; qualified for other members of the Royal Family and Household and for honours.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, prejudice-based. Disclosure would, or would be likely to, endanger the physical or mental health or safety of any individual.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified, class-based. Applies to information the authority must make available under the EIR, so the request is handled under the EIR instead.

Disapplies. s.1(1)(a) and (b).

In practice a routing provision rather than a reason to withhold.

Trigger. Absolute. The information is the requester's own personal data. Handled as a subject access request instead.

Disapplies. s.1(1)(a) and (b).

Trigger. Absolute where disclosure to the public would contravene the data protection principles (the first condition); otherwise conditions linked to the data subject's rights apply, some subject to the public interest test.

Disapplies. s.1(1)(b).

Disclosure under FOIA is treated as disclosure to the world, which is why the principles test is usually decisive.

Trigger. Absolute. The information was obtained from another person and disclosure would constitute an actionable breach of confidence. A public interest defence to the breach of confidence is built into that test.

Disapplies. s.1(1)(b).

Trigger. Qualified, class-based. Information in respect of which a claim to legal professional privilege could be maintained in legal proceedings. The public interest in maintaining privilege carries substantial inherent weight.

Disapplies. s.1(1)(a) and (b).

Trigger. Qualified. Trade secrets (class-based), or information whose disclosure would, or would be likely to, prejudice the commercial interests of any person, including the authority.

Disapplies. s.1(1)(a) and (b).

Trigger. Absolute. Disclosure is prohibited by or under another enactment, incompatible with an obligation the statute preserves, or would be contempt of court.

Disapplies. s.1(1)(a) and (b).

Trigger. Not an exemption: a ground for refusal. Applies where the estimated cost of complying exceeds the appropriate limit set in the fees regulations. Advice and assistance on narrowing the request should be offered (s.16).

Disapplies. s.1(1).

Trigger. Not an exemption: a ground for refusal. The request is vexatious (judged on the request, not the requester, though context and history count), or repeats an identical or substantially similar request without a reasonable interval.

Disapplies. s.1(1).

Trigger. Consent is not required where storage of or access to information on terminal equipment is strictly necessary, or falls within the DUAA-introduced exceptions (e.g. cookies used only for statistical/analytics purposes to measure or improve a service, subject to specified conditions including transparency and an opt-out). Not automatic, the conditions must be met and the ICO's refreshed storage-and-access guidance applies.

Disapplies. reg. 6 consent requirement for the specified low-risk categories.

Advertising and cross-site profiling cookies remain outside the exception and still require consent.

Trigger. A sender may email/text market to an individual without prior consent only where all conditions are met: the contact details were obtained in the course of a sale or negotiations for a sale of a product or service to that person; the marketing is for the sender's own similar products or services; and the recipient was given a simple means to opt out at collection and in every message.

The soft opt-in is a narrow, condition-bound exception, not a general permission to email customers.

Trigger. A charity may send email or text marketing without prior consent where it obtained the contact details when the person expressed an interest in, or offered or gave support for, its charitable purposes; the marketing is for the sole purpose of furthering those purposes; and the person was given a simple means to refuse at collection and in every message. All conditions must be met.

Disapplies. reg. 22(2) prior consent requirement, for qualifying charity marketing.

In force 2026-02-05 (SI 2026/82). The rule is PECR reg 22(3A), inserted by DUAA 2025 s.114.

Trigger. Not automatic. Applies only to the extent that applying the listed UK GDPR provisions would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of tax. It is a case-by-case prejudice test applied by the controller, not a blanket carve-out.

Disapplies. listed transparency and subject-access provisions.

The prejudice test, not the mere existence of the exemption, is the answer a practitioner needs.