Legalize / United Kingdom / Public General Act

Data Protection Act 2018

Type Public General Act

Publication 2018-05-23

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles 2

Reform history JSON API

A record maintained by the controller, or the controller's representative, under Article 30 of the UK GDPR in respect of the processing of personal data in reliance on a condition described in paragraph 38 must include the following information—

(a) which condition is relied on,

(b) how the processing satisfies Article 6 of the UK GDPR (lawfulness of processing), and

(c) whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.

SCHEDULE 2

PART 1 — Adaptations and restrictions as described in Articles 6(3) and 23(1)

1

In this Part of this Schedule, “the listed GDPR provisions” means—

(a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and

(b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)—

(i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;

(ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Crime and taxation: general

2

(1) The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—

(a) the prevention , investigation or detection of crime,

(b) the apprehension or prosecution of offenders, or

to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) to (c).

(2) Sub-paragraph (3) applies where—

(a) personal data is processed by a person (“Controller 1”) for any of the purposes mentioned in sub-paragraph (1)(a) to (c), and

(b) another person (“Controller 2”) obtains the data from Controller 1 for the purpose of discharging statutory functions and processes it for the purpose of discharging statutory functions.

(3) Controller 2 is exempt from the obligations in the following provisions of the UK GDPR—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided),

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c),

to the same extent that Controller 1 is exempt from those obligations by virtue of sub-paragraph (1).

Crime and taxation: risk assessment systems

3

(1) The UK GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively.

(2) A risk assessment system falls within this sub-paragraph if—

(a) it is operated by a government department, a local authority or another authority administering housing benefit, and

(b) it is operated for the purposes of—

(i) the assessment or collection of a tax or duty or an imposition of a similar nature, or

(ii) the prevention , investigation or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.

(3) The UK GDPR provisions referred to in sub-paragraph (1) are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c).

Immigration

4

(1) The relevant UK GDPR provisions do not apply to personal data processed by the Secretary of State for any of the following purposes—

(a) the maintenance of effective immigration control, or

(b) the investigation or detection of activities that would undermine the maintenance of effective immigration control,

to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).

(1A) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(1B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(1C) Paragraphs 4A and 4B make provision about ... safeguards in connection with the exemption in sub-paragraph (1).

(2) In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions” are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 17(1) and (2) (right to erasure);

(e) Article 18(1) (restriction of processing);

(f) Article 21(1) (objections to processing);

(g) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).

(That is, the listed GDPR provisions other than Article 16 (right to rectification), Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing) and Article 20(1) and (2) (right to data portability) and, subject to sub-paragraph (2)(g) of this paragraph, the provisions of Article 5 listed in paragraph 1(b).)

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Information required to be disclosed by law etc or in connection with legal proceedings

5

(1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.

(2) The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.

(3) The listed GDPR provisions do not apply to personal data where disclosure of the data—

(a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

to the extent that the application of those provisions would prevent the controller from making the disclosure.

PART 2 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34

6

In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 16 (right to rectification);

(e) Article 17(1) and (2) (right to erasure);

(f) Article 18(1) (restriction of processing);

(g) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(h) Article 20(1) and (2) (right to data portability);

(i) Article 21(1) (objections to processing);

(j) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).

Functions designed to protect the public etc

7

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—

(a) is designed as described in column 1 of the Table, and

(b) meets the condition relating to the function specified in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

Audit functions

8

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

(2) The functions are any function that is conferred by an enactment on—

(a) the Comptroller and Auditor General;

(b) the Auditor General for Scotland;

(d) the Comptroller and Auditor General for Northern Ireland.

Functions of the Bank of England

9

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

(2) “Relevant function of the Bank of England” means—

(a) a function discharged by the Bank acting in its capacity as a monetary authority (as defined in section 244(2)(c) and (2A) of the Banking Act 2009);

(b) a public function of the Bank within the meaning of section 349 of the Financial Services and Markets Act 2000;

(c) a function conferred on the Prudential Regulation Authority by or under the Financial Services and Markets Act 2000 or by another enactment.

Regulatory functions relating to legal services, the health service and children’s services

10

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

(2) The functions are—

(a) a function of the Legal Services Board;

(b) the function of considering a complaint under the scheme established under Part 6 of the Legal Services Act 2007 (legal complaints);

(i) section 14 of the NHS Redress Act 2006,

(ii) section 113(1) or (2) or section 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003,

(iii) section 24D or 26 of the Children Act 1989, or

(iv) Part 2A of the Public Services Ombudsman (Wales) Act 2005 or Part 5 of the Public Services Ombudsman (Wales) Act 2019;

(d) the function of considering a complaint or representations under Chapter 1 of Part 10 of the Social Services and Well-being (Wales) Act 2014 (anaw 4).

Regulatory functions of certain other persons

11

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—

(a) is a function of a person described in column 1 of the Table, and

(b) is conferred on that person as described in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

12

In the Table in paragraph 11—

the “Financial Ombudsman” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act);

the “investigator of complaints against the financial regulators” means the person appointed under section 84(1)(b) of the Financial Services Act 2012;

“relevant authority” has the same meaning as in section 5 of the Local Government and Housing Act 1989, and “monitoring officer”, in relation to such an authority, means a person designated as such under that section;

“relevant Welsh authority” has the same meaning as “relevant authority” in section 49(6) of the Local Government Act 2000, and “monitoring officer”, in relation to such an authority, has the same meaning as in Part 3 of that Act.

Parliamentary privilege

13

The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

Judicial appointments, judicial independence and judicial proceedings

14

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for judicial office or the office of Queen's Counsel.

(2) The listed GDPR provisions do not apply to personal data processed by—

(a) an individual acting in a judicial capacity, or

(b) a court or tribunal acting in its judicial capacity.

(3) As regards personal data not falling within sub-paragraph (1) or (2), the listed GDPR provisions do not apply to the extent that the application of those provisions would be likely to prejudice judicial independence or judicial proceedings.

Crown honours, dignities and appointments

15

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.

(2) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for any of the following offices—

(a) archbishops and diocesan and suffragan bishops in the Church of England;

(b) deans of cathedrals of the Church of England;

(d) the First and Second Church Estates Commissioners;

(e) lord-lieutenants;

(f) Masters of Trinity College and Churchill College, Cambridge;

(g) the Provost of Eton;

(h) the Poet Laureate;

(i) the Astronomer Royal.

(3) The Secretary of State may by regulations amend the list in sub-paragraph (2) to—

(a) remove an office, or

(b) add an office to which appointments are made by Her Majesty.

(4) Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.

PART 3 — Restriction for the protection of rights of others

Protection of the rights of others: general

16

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the UK GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.

(2) Sub-paragraph (1) does not remove the controller's obligation where—

(a) the other individual has consented to the disclosure of the information to the data subject, or

(b) it is reasonable to disclose the information to the data subject without the consent of the other individual.

(3) In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—

(a) the type of information that would be disclosed,

(b) any duty of confidentiality owed to the other individual,

(d) whether the other individual is capable of giving consent, and

(e) any express refusal of consent by the other individual.

(4) For the purposes of this paragraph—

(a) “information relating to another individual” includes information identifying the other individual as the source of information;

(b) an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—

(i) that information, or

(ii) that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.

17

(1) For the purposes of paragraph 16(2)(b), it is to be considered reasonable for a controller to disclose information to a data subject without the consent of the other individual where—

(a) the health data test is met,

(b) the social work data test is met, or

(2) The health data test is met if—

(a) the information in question is contained in a health record, and

(b) the other individual is a health professional who has compiled or contributed to the health record or who, in his or her capacity as a health professional, has been involved in the diagnosis, care or treatment of the data subject.

(3) The social work data test is met if—

(a) the other individual is—

(i) a children's court officer,

(ii) a person who is or has been employed by a person or body referred to in paragraph 8 of Schedule 3 in connection with functions exercised in relation to the information, or

(iii) a person who has provided for reward a service that is similar to a service provided in the exercise of any relevant social services functions, and

(b) the information relates to the other individual in an official capacity or the other individual supplied the information—

(i) in an official capacity, or

(ii) in a case within paragraph (a)(iii), in connection with providing the service mentioned in paragraph (a)(iii).

(4) The education data test is met if—

(a) the other individual is an education-related worker, or

(b) the other individual is employed by an education authority (within the meaning of the Education (Scotland) Act 1980) in pursuance of its functions relating to education and—

(i) the information relates to the other individual in his or her capacity as such an employee, or

(ii) the other individual supplied the information in his or her capacity as such an employee.

(5) In this paragraph—

“children's court officer” means a person referred to in paragraph 8(1)(q), (r), (s), (t) or (u) of Schedule 3;

“education-related worker” means a person referred to in paragraph 14(4)(a) or (b) or 16(4)(a), (b) or (c) of Schedule 3 (educational records);

“relevant social services functions” means functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3.

PART 4 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15

18

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (c).

Legal professional privilege

19

The listed GDPR provisions do not apply to personal data that consists of—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

Self incrimination

20

(1) A person need not comply with the listed GDPR provisions to the extent that compliance would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.

(2) The reference to an offence in sub-paragraph (1) does not include an offence under—

(a) this Act,

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), or

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(3) Information disclosed by any person in compliance with Article 15 of the UK GDPR is not admissible against the person in proceedings for an offence under this Act.

Corporate finance

21

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of or in connection with a corporate finance service provided by a relevant person to the extent that either Condition A or Condition B is met.

(2) Condition A is that the application of the listed GDPR provisions would be likely to affect the price of an instrument.

(3) Condition B is that—

(a) the relevant person reasonably believes that the application of the listed GDPR provisions to the personal data in question could affect a decision of a person—

(i) whether to deal in, subscribe for or issue an instrument, or

(ii) whether to act in a way likely to have an effect on a business activity (such as an effect on the industrial strategy of a person, the capital structure of an undertaking or the legal or beneficial ownership of a business or asset), and

(b) the application of the listed GDPR provisions to that personal data would have a prejudicial effect on the orderly functioning of financial markets or the efficient allocation of capital within the economy.

(4) In this paragraph—

“corporate finance service” means a service consisting in—underwriting in respect of issues of, or the placing of issues of, any instrument,services relating to such underwriting, oradvice to undertakings on capital structure, industrial strategy and related matters and advice and service relating to mergers and the purchase of undertakings;

“instrument” means an instrument listed in section C of Annex 1 to Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, and references to an instrument include an instrument not yet in existence but which is to be or may be created;

“price” includes value;

“relevant person” means—a person who, by reason of a permission under Part 4A of the Financial Services and Markets Act 2000, is able to carry on a corporate finance service without contravening the general prohibition;an EEA firm of the kind mentioned in paragraph 5(a) or (b) of Schedule 3 to that Act which has qualified for authorisation under paragraph 12 of that Schedule, and may lawfully carry on a corporate finance service;a person who is exempt from the general prohibition in respect of any corporate finance service—as a result of an exemption order made under section 38(1) of that Act, orby reason of section 39(1) of that Act (appointed representatives);a person, not falling within paragraph (a), (b) or (c), who may lawfully carry on a corporate finance service without contravening the general prohibition;a person who, in the course of employment, provides to their employer a service falling within paragraph (b) or (c) of the definition of “corporate finance service”;a partner who provides to other partners in the partnership a service falling within either of those paragraphs.

(5) In the definition of “relevant person” in sub-paragraph (4), references to “the general prohibition” are to the general prohibition within the meaning of section 19 of the Financial Services and Markets Act 2000.

Management forecasts

22

The listed GDPR provisions do not apply to personal data processed for the purposes of management forecasting or management planning in relation to a business or other activity to the extent that the application of those provisions would be likely to prejudice the conduct of the business or activity concerned.

Negotiations

23

The listed GDPR provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of those provisions would be likely to prejudice those negotiations.

Confidential references

24

The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of—

(a) the education, training or employment (or prospective education, training or employment) of the data subject,

(b) the placement (or prospective placement) of the data subject as a volunteer,

(d) the provision (or prospective provision) by the data subject of any service.

Exam scripts and exam marks

25

(1) The listed GDPR provisions do not apply to personal data consisting of information recorded by candidates during an exam.

(2) Where personal data consists of marks or other information processed by a controller—

(a) for the purposes of determining the results of an exam, or

(b) in consequence of the determination of the results of an exam,

the duty in Article 12(3) or (4) of the UK GDPR for the controller to provide information requested by the data subject within a certain time period, as it applies to Article 15 of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), is modified as set out in sub-paragraph (3).

(3) Where a question arises as to whether the controller is obliged by Article 15 of the UK GDPR to disclose personal data, and the question arises before the day on which the exam results are announced, the controller must provide the information mentioned in Article 12(3) or (4)—

(a) before the end of the period of 5 months beginning when the question arises, or

(b) if earlier, before the end of the period of 40 days beginning with the announcement of the results.

(4) In this paragraph, “exam” means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity.

(5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.

PART 5 — Exemptions etc ... for reasons of freedom of expression and information

Journalistic, academic, artistic and literary purposes

26

(1) In this paragraph, “the special purposes” means one or more of the following—

(a) the purposes of journalism;

(b) academic purposes;

(d) literary purposes.

(2) Sub-paragraph (3) applies to the processing of personal data carried out for the special purposes if—

(a) the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and

(b) the controller reasonably believes that the publication of the material would be in the public interest.

(3) The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.

(4) In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.

(5) In determining whether it is reasonable to believe that publication would be in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (6) that is relevant to the publication in question.

(6) The codes of practice and guidelines are—

(a) BBC Editorial Guidelines;

(b) Ofcom Broadcasting Code;

(7) The Secretary of State may by regulations amend the list in sub-paragraph (6).

(8) Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.

(9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR (which may be exempted or derogated from by virtue of Article 85(2) of the UK GDPR)—

(a) in Chapter II of the UK GDPR (principles)—

(i) Article 5(1)(a) to (e) (principles relating to processing);

(ii) Article 6 (lawfulness);

(iii) Article 7 (conditions for consent);

(iv) Article 8(1) and (2) (child's consent);

(v) Article 9 (processing of special categories of data);

(vi) Article 10 (data relating to criminal convictions etc);

(vii) Article 11(2) (processing not requiring identification);

(b) in Chapter III of the UK GDPR (rights of the data subject)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1)(a), (b) and (d) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(i) Article 34(1) and (4) (communication of personal data breach to the data subject);

(ii) Article 36 (requirement for controller to consult Commissioner prior to high risk processing);

(d) in Chapter V of the UK GDPR (transfers of data to third countries etc), Article 44A (general principles for transfers);

(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 6 — Derogations etc ... for research, statistics and archiving

Research and statistics

27

(1) The listed GDPR provisions do not apply to personal data processed for—

(a) scientific or historical research purposes, or

(b) statistical purposes,

to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.

This is subject to sub-paragraphs (3) and (4).

(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—

(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(b) Article 16 (right to rectification);

(d) Article 21(1) (objections to processing).

(3) The exemption in sub-paragraph (1) is available only where—

(a) the personal data is processed in accordance with Article 84B of the UK GDPR, and

(b) as regards the disapplication of Article 15(1) to (3), the results of the research or any resulting statistics are not made available in a form which identifies a data subject.

(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.

Archiving in the public interest

28

(1) The listed GDPR provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.

This is subject to sub-paragraphs (3) and (4).

(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—

(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(b) Article 16 (right to rectification);

(d) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(e) Article 20(1) (right to data portability);

(f) Article 21(1) (objections to processing).

(3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with Article 84B of the UK GDPR.

(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.

SCHEDULE 3

1

In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 16 (right to rectification);

(e) Article 17(1) and (2) (right to erasure);

(f) Article 18(1) (restriction of processing);

(g) Article 20(1) and (2) (right to data portability);

(h) Article 21(1) (objections to processing);

(i) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (h).

PART 2 — Health data

Definitions

2

(1) In this Part of this Schedule—

“the appropriate health professional”, in relation to a question as to whether the serious harm test is met with respect to data concerning health, means—the health professional who is currently or was most recently responsible for the diagnosis, care or treatment of the data subject in connection with the matters to which the data relates,where there is more than one such health professional, the health professional who is the most suitable to provide an opinion on the question, ora health professional who has the necessary experience and qualifications to provide an opinion on the question, where—there is no health professional available falling within paragraph (a) or (b), orthe controller is the Secretary of State and data is processed in connection with the exercise of the functions conferred on the Secretary of State by or under the Child Support Act 1991 and the Child Support Act 1995, or the Secretary of State's functions in relation to social security or war pensions, orthe controller is the Department for Communities in Northern Ireland and data is processed in connection with the exercise of the functions conferred on the Department by or under the Child Support (Northern Ireland) Order 1991 (S.I. 1991/2628 (N.I. 23)) and the Child Support (Northern Ireland) Order 1995 (S.I. 1995/2702 (N.I. 13));

“war pension” has the same meaning as in section 25 of the Social Security Act 1989 (establishment and functions of war pensions committees).

(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to data concerning health if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

3

(1) The listed GDPR provisions do not apply to data concerning health if—

(a) it is processed by a court,

(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and

(2) Those rules are—

(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);

(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));

(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);

(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(f) the Sheriff Court Adoption Rules 2009;

(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

4

(1) This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and—

(a) in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,

(b) in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or

(c) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2) The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—

(a) which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,

(b) which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or

(3) The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.

5

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.

(2) A controller who is not a health professional may not rely on sub-paragraph (1) to withhold data concerning health unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is met with respect to the data.

(3) An opinion does not count for the purposes of sub-paragraph (2) if—

(a) it was obtained before the beginning of the relevant period, or

(b) it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.

(4) In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.

6

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.

(2) Sub-paragraph (1) does not apply to the extent that the controller is satisfied that the data concerning health has already been seen by, or is within the knowledge of, the data subject.

(3) An opinion does not count for the purposes of sub-paragraph (1) if—

(a) it was obtained before the beginning of the relevant period, or

(b) it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.

(4) In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.

Definitions

7

(1) In this Part of this Schedule—

“education data” has the meaning given by paragraph 17 of this Schedule;

“Health and Social Care trust” means a Health and Social Care trust established under the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1));

“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;

“social work data” means personal data which—is data to which paragraph 8 applies, butis not education data or data concerning health.

(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to social work data if the application of Article 15 of the UK GDPR to the data would be likely to prejudice carrying out social work, because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

(3) In sub-paragraph (2), “carrying out social work” is to be taken to include doing any of the following—

(a) the exercise of any functions mentioned in paragraph 8(1)(a), (d), (f) to (j), (m), (p), (s), (t), (u), (v) or (w);

(b) the provision of any service mentioned in paragraph 8(1)(b), (c) or (k);

(c) the exercise of the functions of a body mentioned in paragraph 8(1)(e) or a person mentioned in paragraph 8(1)(q) or (r).

(4) In this Part of this Schedule, a reference to a local authority, in relation to data processed or formerly processed by it, includes a reference to the Council of the Isles of Scilly, in relation to data processed or formerly processed by the Council in connection with any functions mentioned in paragraph 8(1)(a)(ii) which are or have been conferred on the Council by an enactment.

8

(1) This paragraph applies to personal data falling within any of the following descriptions—

(a) data processed by a local authority—

(i) in connection with its social services functions (within the meaning of the Local Authority Social Services Act 1970 or the Social Services and Well-being (Wales) Act 2014 (anaw 4)) or any functions exercised by local authorities under the Social Work (Scotland) Act 1968 or referred to in section 5(1B) of that Act, or

(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with any of the functions mentioned in sub-paragraph (i);

(b) data processed by the Department of Health in Northern Ireland or any person or body exercising functions by virtue of paragraph 22A of Schedule 3 to the Health and Personal Social Services (Northern Ireland) Order 1991—

(i) in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)), or

(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;

(i) in the exercise of social care and children functions within the meaning of Article 10A of the Health and Personal Social Services (Northern Ireland) Order 1991,

(ia) in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)) by virtue of a delegation direction under Article 10B of the Health and Personal Social Services (Northern Ireland) Order 1991, or

(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;

(d) data processed by a council in the exercise of its functions under Part 2 of Schedule 9 to the Health and Social Services and Social Security Adjudications Act 1983;

(e) data processed by—

(i) a probation trust established under section 5 of the Offender Management Act 2007, or

(ii) the Probation Board for Northern Ireland established by the Probation Board (Northern Ireland) Order 1982 (S.I. 1982/713 (N.I. 10));

(f) data processed by a local authority in the exercise of its functions under section 36 of the Children Act 1989 or Chapter 2 of Part 6 of the Education Act 1996, so far as those functions relate to ensuring that children of compulsory school age (within the meaning of section 8 of the Education Act 1996) receive suitable education whether by attendance at school or otherwise;

(g) data processed by the Education Authority in the exercise of its functions under Article 55 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 45 of, and Schedule 13 to, the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)), so far as those functions relate to ensuring that children of compulsory school age (within the meaning of Article 46 of the Education and Libraries (Northern Ireland) Order 1986) receive efficient full-time education suitable to their age, ability and aptitude and to any special educational needs they may have, either by regular attendance at school or otherwise;

(h) data processed by an education authority in the exercise of its functions under sections 35 to 42 of the Education (Scotland) Act 1980 so far as those functions relate to ensuring that children of school age (within the meaning of section 31 of the Education (Scotland) Act 1980) receive efficient education suitable to their age, ability and aptitude, whether by attendance at school or otherwise;

(i) data relating to persons detained in a hospital at which high security psychiatric services are provided under section 4 of the National Health Service Act 2006 and processed by a Special Health Authority established under section 28 of that Act in the exercise of any functions similar to any social services functions of a local authority;

(j) data relating to persons detained in special accommodation provided under Article 110 of the Mental Health (Northern Ireland) Order 1986 (S.I. 1986/595 (N.I. 4)) and processed by a Health and Social Care trust in the exercise of any functions similar to any social services functions of a local authority;

(k) data which—

(i) is processed by the National Society for the Prevention of Cruelty to Children, or by any other voluntary organisation or other body designated under this paragraph by the Secretary of State or the Department of Health in Northern Ireland, and

(ii) appears to the Secretary of State or the Department, as the case may be, to be processed for the purposes of the provision of any service similar to a service provided in the exercise of any functions specified in paragraph (a), (b), (c) or (d);

(l) data processed by a body mentioned in sub-paragraph (2)—

(i) which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (k) or from a government department, and

(ii) in the case of data obtained, or consisting of information obtained, from an authority or body mentioned in any of paragraphs (a) to (k), fell within any of those paragraphs while processed by the authority or body;

(m) data processed by a National Health Service trust first established under section 25 of the National Health Service Act 2006, section 18 of the National Health Service (Wales) Act 2006 or section 5 of the National Health Service and Community Care Act 1990 in the exercise of any functions similar to any social services functions of a local authority;

(n) data processed by an NHS foundation trust in the exercise of any functions similar to any social services functions of a local authority;

(o) data processed by a government department—

(i) which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (n), and

(ii) which fell within any of those paragraphs while processed by that authority or body;

(p) data processed for the purposes of the functions of the Secretary of State pursuant to section 82(5) of the Children Act 1989;

(q) data processed by—

(i) a children's guardian appointed under Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17)),

(ii) a guardian ad litem appointed under Article 60 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 66 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22)), or

(iii) a safeguarder appointed under section 30(2) or 31(3) of the Children's Hearings (Scotland) Act 2011 (asp 1);

(r) data processed by the Principal Reporter;

(s) data processed by an officer of the Children and Family Court Advisory and Support Service for the purpose of the officer's functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(t) data processed by the Welsh family proceedings officer for the purposes of the functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010;

(u) data processed by an officer of the service appointed as guardian ad litem under Part 16 of the Family Procedure Rules 2010;

(v) data processed by the Children and Family Court Advisory and Support Service for the purpose of its functions under section 12(1) and (2) and section 13(1), (2) and (4) of the Criminal Justice and Court Services Act 2000;

(w) data processed by the Welsh Ministers for the purposes of their functions under section 35(1) and (2) and section 36(1), (2), (4), (5) and (6) of the Children Act 2004;

(x) data processed for the purposes of the functions of the appropriate Minister pursuant to section 12 of the Adoption and Children Act 2002 (independent review of determinations).

(2) The bodies referred to in sub-paragraph (1)(l) are—

(a) a National Health Service trust first established under section 25 of the National Health Service Act 2006 or section 18 of the National Health Service (Wales) Act 2006;

(b) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;

(d) an integrated care board established under section 14Z25 of the National Health Service Act 2006;

(e) NHS England;

(f) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;

(g) a Health Board established under section 2 of the National Health Service (Scotland) Act 1978.

9

(1) The listed GDPR provisions do not apply to data that is not education data or data concerning health if—

(a) it is processed by a court,

(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and

(c) in accordance with any of those rules, the data may be withheld by the court in whole or in part from the data subject.

(2) Those rules are—

(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);

(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));

(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);

(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(f) the Sheriff Court Adoption Rules 2009;

(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

10

(1) This paragraph applies where a request for social work data is made in exercise of a power conferred by an enactment or rule of law and—

(a) in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,

(b) in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or

(c) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2) The listed GDPR provisions do not apply to social work data to the extent that complying with the request would disclose information—

(a) which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,

(b) which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or

(3) The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.

11

Article 15 (1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to the extent that the serious harm test is met with respect to the data.

12

(1) This paragraph applies where—

(a) a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose social work data, and

(b) the data—

(i) originated from or was supplied by the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and

(ii) is not data which the data subject is entitled to receive from the Principal Reporter.

(2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.

(3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.

(4) In this paragraph “social work authority” means a local authority for the purposes of the Social Work (Scotland) Act 1968.

PART 4 — Education data

Educational records

13

In this Part of this Schedule “educational record” means a record to which paragraph 14, 15 or 16 applies.

14

(1) This paragraph applies to a record of information which—

(a) is processed by or on behalf of the proprietor of, or a teacher at, a school in England and Wales specified in sub-paragraph (3),

(b) relates to an individual who is or has been a pupil at the school, and

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) The schools referred to in sub-paragraph (1)(a) are—

(a) a school maintained by a local authority;

(b) an Academy school;

(d) an independent school that is not an Academy school or an alternative provision Academy;

(e) a non-maintained special school.

(4) The persons referred to in sub-paragraph (1)(c) are—

(a) an employee of the local authority which maintains the school;

(b) in the case of—

(i) a voluntary aided, foundation or foundation special school (within the meaning of the School Standards and Framework Act 1998),

(ii) an Academy school,

(iii) an alternative provision Academy,

(iv) an independent school that is not an Academy school or an alternative provision Academy, or

(v) a non-maintained special school,

a teacher or other employee at the school (including an educational psychologist engaged by the proprietor under a contract for services);

(d) a parent, as defined by section 576(1) of the Education Act 1996, of that pupil.

(5) In this paragraph—

“independent school” has the meaning given by section 463 of the Education Act 1996;

“local authority” has the same meaning as in that Act (see sections 579(1) and 581 of that Act);

“non-maintained special school” has the meaning given by section 337A of that Act;

“proprietor” has the meaning given by section 579(1) of that Act.

15

(1) This paragraph applies to a record of information which is processed—

(a) by an education authority in Scotland, and

(b) for the purpose of the relevant function of the authority.

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) For the purposes of this paragraph, information processed by an education authority is processed for the purpose of the relevant function of the authority if the processing relates to the discharge of that function in respect of a person—

(a) who is or has been a pupil in a school provided by the authority, or

(b) who receives, or has received, further education provided by the authority.

(4) In this paragraph “the relevant function” means, in relation to each education authority, its function under section 1 of the Education (Scotland) Act 1980 and section 7(1) of the Self-Governing Schools etc. (Scotland) Act 1989.

16

(1) This paragraph applies to a record of information which—

(a) is processed by or on behalf of the Board of Governors, proprietor or trustees of, or a teacher at, a school in Northern Ireland specified in sub-paragraph (3),

(b) relates to an individual who is or has been a pupil at the school, and

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) The schools referred to in sub-paragraph (1)(a) are—

(a) a grant-aided school;

(b) an independent school.

(4) The persons referred to in sub-paragraph (1)(c) are—

(a) a teacher at the school;

(b) an employee of the Education Authority, other than a teacher at the school;

(d) the pupil to whom the record relates;

(e) a parent, as defined by Article 2(2) of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).

(5) In this paragraph, “grant-aided school”, “independent school”, “proprietor” and “trustees” have the same meaning as in the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).

Other definitions

17

(1) In this Part of this Schedule—

“education authority” and “further education” have the same meaning as in the Education (Scotland) Act 1980;

“education data” means personal data consisting of information which—constitutes an educational record, butis not data concerning health;

“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;

“pupil” means—in relation to a school in England and Wales, a registered pupil within the meaning of the Education Act 1996,in relation to a school in Scotland, a pupil within the meaning of the Education (Scotland) Act 1980, andin relation to a school in Northern Ireland, a registered pupil within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3));

“school”—in relation to England and Wales, has the same meaning as in the Education Act 1996,in relation to Scotland, has the same meaning as in the Education (Scotland) Act 1980, andin relation to Northern Ireland, has the same meaning as in the Education and Libraries (Northern Ireland) Order 1986;

“teacher” includes—in Great Britain, head teacher, andin Northern Ireland, the principal of a school.

(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to education data if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

18

(1) The listed GDPR provisions do not apply to education data if—

(a) it is processed by a court,

(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and

(2) Those rules are—

(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);

(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));

(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);

(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(f) the Sheriff Court Adoption Rules 2009;

(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

19

Article 15 (1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to the extent that the serious harm test is met with respect to the data.

20

(1) This paragraph applies where—

(a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose education data, and

(b) the controller believes that the data—

(i) originated from or was supplied by or on behalf of the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and

(ii) is not data which the data subject is entitled to receive from the Principal Reporter.

(2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.

(3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.

PART 5 — Child abuse data

21

(1) This paragraph applies where a request for child abuse data is made in exercise of a power conferred by an enactment or rule of law and—

(a) the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject, or

(b) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to child abuse data to the extent that the application of that provision would not be in the best interests of the data subject.

(3) “Child abuse data” is personal data consisting of information as to whether the data subject is or has been the subject of, or may be at risk of, child abuse.

(4) For this purpose, “child abuse” includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, an individual aged under 18.

(5) This paragraph does not apply in relation to Scotland.

SCHEDULE 4

1

In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(b) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3).

Human fertilisation and embryology information

2

The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of sections 31, 31ZA to 31ZE and 33A to 33D of the Human Fertilisation and Embryology Act 1990.

Adoption records and reports

3

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2), (3) or (4).

(2) The enactments extending to England and Wales are—

(a) regulation 14 of the Adoption Agencies Regulations 1983 (S.I. 1983/1964);

(b) regulation 41 of the Adoption Agencies Regulations 2005 (S.I. 2005/389);

(d) rules 5, 6, 9, 17, 18, 21, 22 and 53 of the Adoption Rules 1984 (S.I. 1984/265);

(e) rules 24, 29, 30, 65, 72, 73, 77, 78 and 83 of the Family Procedure (Adoption) Rules 2005 (S.I. 2005/2795 (L. 22));

(f) in the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17)), rules 14.6, 14.11, 14.12, 14.13, 14.14, 14.24, 16.20 (so far as it applies to a children's guardian appointed in proceedings to which Part 14 of those Rules applies), 16.32 and 16.33 (so far as it applies to a children and family reporter in proceedings to which Part 14 of those Rules applies).

(3) The enactments extending to Scotland are—

(a) regulation 23 of the Adoption Agencies (Scotland) Regulations 1996 (S.I. 1996/3266 (S. 254));

(b) rule 67.3 of the Act of Sederunt (Rules of the Court of Session 1994) 1994 (S.I. 1994/1443 (S. 69));

(c) rules 10.3, 17.2, 21, 25, 39, 43.3, 46.2 and 47 of the Act of Sederunt (Sheriff Court Rules Amendment) (Adoption and Children (Scotland) Act 2007) 2009 (S.S.I. 2009/284);

(d) sections 53 and 55 of the Adoption and Children (Scotland) Act 2007 (asp 4);

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.

Data Protection Act 2018

SCHEDULE 2

PART 1 — Adaptations and restrictions as described in Articles 6(3) and 23(1)

GDPR provisions to be adapted or restricted: “the listed GDPR provisions”

1

Crime and taxation: general

2

Crime and taxation: risk assessment systems

3

Immigration

4

Information required to be disclosed by law etc or in connection with legal proceedings

5

PART 2 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34

GDPR provisions to be restricted: “the listed GDPR provisions”

6

Functions designed to protect the public etc

7

Audit functions

8

Functions of the Bank of England

9

Regulatory functions relating to legal services, the health service and children’s services

10

Regulatory functions of certain other persons

11

12

Parliamentary privilege

13

Judicial appointments, judicial independence and judicial proceedings

14

Crown honours, dignities and appointments

15

PART 3 — Restriction for the protection of rights of others

Protection of the rights of others: general

16

Assumption of reasonableness for health workers, social workers and education workers

17

PART 4 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15

GDPR provisions to be restricted: “the listed GDPR provisions”

18

Legal professional privilege

19

Self incrimination

20

Corporate finance

21

Management forecasts

22

Negotiations

23

Confidential references

24

Exam scripts and exam marks

25

PART 5 — Exemptions etc ... for reasons of freedom of expression and information

Journalistic, academic, artistic and literary purposes

26

PART 6 — Derogations etc ... for research, statistics and archiving

Research and statistics

27

Archiving in the public interest

28

SCHEDULE 3

PART 1 — UK GDPR provisions to be restricted

1

PART 2 — Health data

Definitions

2

Exemption from the listed GDPR provisions: data processed by a court

3

Exemption from the listed GDPR provisions: data subject’s expectations and wishes

4

Exemption from Article 15 of the GDPR: serious harm

5

Restriction of Article 15 of the GDPR: prior opinion of appropriate health professional

6

PART 3 — Social work data

Definitions

7