Data Protection Act 2018, Schedule 2, paragraph 2

Crime and taxation: general

SCHEDULE 2 Exemptions etc from the UK GDPR

2 (1) The listed GDPR provisions and Article 34(1) and (4) of the [F887UK GDPRF887] (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—

(a) the prevention [F888, investigationF888] or detection of crime,

(b) the apprehension or prosecution of offenders, or

(c) the assessment or collection of a tax or duty or an imposition of a similar nature,

to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) to (c).

(2) Sub-paragraph (3) applies where—

(a) personal data is processed by a person (“Controller 1”) for any of the purposes mentioned in sub-paragraph (1)(a) to (c), and

(b) another person (“Controller 2”) obtains the data from Controller 1 for the purpose of discharging statutory functions and processes it for the purpose of discharging statutory functions.

(3) Controller 2 is exempt from the obligations in the following provisions of the [F889UK GDPRF889] —

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided),

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),

(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers), and

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c),

to the same extent that Controller 1 is exempt from those obligations by virtue of sub-paragraph (1).

Definitions used in Schedule 2, paragraph 2 1

the listed GDPR provisions

1 In this Part of this Schedule, “the listed GDPR provisions” means—

(a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and

(b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR )—

(i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;

(ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Defined in Sch.2 para.1 · see it in the full Act

18 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (c).

Defined in Sch.2 para.18 · see it in the full Act

6 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d) Article 16 (right to rectification);

(e) Article 17(1) and (2) (right to erasure);

(f) Article 18(1) (restriction of processing);

(g) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(h) Article 20(1) and (2) (right to data portability);

(i) Article 21(1) (objections to processing);

(j) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).

Defined in Sch.2 para.6 · see it in the full Act

Cases considering Schedule 2, paragraph 2 3

Antony Savva v Leather Inside Out (in liquidation) & Ors

[2025] EAT 96 · 9 July 2025

The tribunal was not required to determine a data-protection claim, but it had to engage with the claimant’s case that the prevention-or-detection-of-crime exemption had no proper factual basis and was a pretext for whistleblowing retaliation. (see paras [99]-[104])

Michael Ashley v The Commissioners for HMRC

[2025] EWHC 134 (KB) · 24 January 2025Defines

Cites the crime-prevention purpose within the general exemption. The court did not rely on this limb in deciding the taxation issue (see paras [69], [199]). Cites the apprehension or prosecution of offenders purpose within the general exemption. The court did not rely on this limb in deciding the taxation issue (see paras [69], [199]). Applies the taxation limb of the exemption. HMRC failed to prove that disclosure was likely to prejudice tax assessment or collection, so the exemption was unavailable for the passage in issue (see paras [69], [134], [198]–[200]).

Ben Peter Delo, R (on the application of) v The Information Commissioner

[2023] EWCA Civ 1141 · 10 October 2023

Applies: the court treated the crime and taxation exemption as a relevant legal basis for Wise’s withholding of data and as an ostensibly legitimate explanation capable of supporting the Commissioner’s rational assessment. (see paras [14]; [83]-[84]; [92]-[94])

What each judgment says about Schedule 2, paragraph 2 is in the case-law panel in the full Act.

Amendments and notes

4 notes from legislation.gov.uk

Amendments

  1. F887Words in Sch. 2 para. 2(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F888Word in Sch. 2 para. 2(1)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 29(2); S.I. 2026/82, reg. 2(z12)
  3. F889Words in Sch. 2 para. 2(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I273Sch. 2 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)