Exemptions to the GDPR in the UK
Exemptions to the GDPR in the UK

The following Information Law guidance note provides comprehensive and up to date legal information covering:

  • Exemptions to the GDPR in the UK
  • Key guidance and resources
  • The scope of the GDPR
  • Exemptions permitted by the GDPR
  • Crime and taxation exemptions
  • Immigration exemption
  • Disclosures required by law or in connection with legal proceedings
  • Discharging regulatory functions
  • Parliamentary privilege exemption
  • Judicial appointments, independence and proceedings
  • more

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection.

This Practice Note introduces the exemptions to the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) which are set out in the Data Protection Act 2018 (DPA 2018). It first considers the scope of the GDPR, then provides an overview of the various exemptions that are potentially available under the DPA 2018, and which cover the following:

  1. crime, law and public protection

  2. regulation, parliament and the judiciary

  3. journalism, research and archiving

  4. health, social work, education and child abuse

  5. finance, management and negotiations

  6. references and exams

  7. subject access requests—information about other people

For a comprehensive introduction to the GDPR, collating key practical guidance, see: GDPR