Chapter 8: Applying Exemptions Chapter – Data Protection Compliance in the UK, Second Edition


The DPA imposes a regime which controls the processing of personal data and imposes obligations on the data controller to provide information to individuals. In Chapter 4, the exemptions to the obligation to provide subject access were noted. The data controller may also be relieved from the obligation to provide notice to individuals in certain circumstances. The exemptions only apply on a case by case basis. A data controller who plans to rely on these should make a proper record of the justification for doing so. In other circumstances, restrictions on disclosure are lifted so that a disclosure may be made even though in normal circumstances it would not be permissible. These include circumstances where information is required for the purposes of journalism or legal proceedings, where information is disclosed in order to deal with regulatory activities, or where the national security or policing exemptions apply. Information which is held by individuals solely for their personal purposes, family or household affairs, is not covered by most of the provisions of the DPA.

Information may also be used for research even if it was not originally obtained for that purpose.

Exemptions are technical and only apply on a case by case basis, so care should be taken when relying on them.