Guide to Data Protection Act for Data Controllers

What is exempted?

This exemption applies to personal data that is required to be disclosed under any enactment, by any law or by a court order.

The exemption also applies where the disclosure of the personal data is necessary:

• for, in connection with or in contemplation of any quasi-judicial or legal proceedings;
• for the purpose of obtaining legal advice;
• otherwise for the purposes of establishing, exercising or defending a legal right. 

What provisions in the DPA does the exemption relate to?

Under this exemption personal data is exempt from:

• the first data protection principle (but compliance with the conditions in schedules 2 and 3 is required);
• the second data protection principle (purpose limitation principle);
• the third data protection principle (data minimization principle);
• section 10 (the right to stop or restrict processing); and
• section 14 (the right to rectification). 

When does the exemption apply?

The exemption applies to the extent that the listed provisions are inconsistent with the disclosure in question. 

Relevant provisions

Data Protection Act (2021 Revision)

Section 25: Exemption relating to disclosures required by law or in connection with legal proceedings