Data Protection Act 2018, Schedule 2, paragraph 26

Journalistic, academic, artistic and literary purposes

SCHEDULE 2 Exemptions etc from the UK GDPR

26 (1) In this paragraph, “the special purposes” means one or more of the following—

(a) the purposes of journalism;

(b) academic purposes;

(c) artistic purposes;

(d) literary purposes.

(2) Sub-paragraph (3) applies to the processing of personal data carried out for the special purposes if—

(a) the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and

(b) the controller reasonably believes that the publication of the material would be in the public interest.

(3) The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.

(4) In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.

(5) In determining whether it is reasonable to believe that publication would be in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (6) that is relevant to the publication in question.

(6) The codes of practice and guidelines are—

(a) BBC Editorial Guidelines;

(b) Ofcom Broadcasting Code;

(c) Editors' Code of Practice.

(7) The Secretary of State may by regulations amend the list in sub-paragraph (6).

(8) Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.

(9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the [F922UK GDPRF922] (which may be exempted or derogated from by virtue of Article 85(2) of the [F922UK GDPRF922] )—

(a) in Chapter II of the [F923UK GDPRF923] (principles)—

(i) Article 5(1)(a) to (e) (principles relating to processing);

(ii) Article 6 (lawfulness);

(iii) Article 7 (conditions for consent);

(iv) Article 8(1) and (2) (child's consent);

(v) Article 9 (processing of special categories of data);

(vi) Article 10 (data relating to criminal convictions etc);

(vii) Article 11(2) (processing not requiring identification);

(b) in Chapter III of the [F924UK GDPRF924] (rights of the data subject)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1)(a), (b) and (d) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(c) in Chapter IV of the [F925UK GDPRF925] (controller and processor)—

(i) Article 34(1) and (4) (communication of personal data breach to the data subject);

(ii) Article 36 (requirement for controller to consult [F926CommissionF926] prior to high risk processing);

(d) in Chapter V of the [F927UK GDPRF927] (transfers of data to third countries etc), Article [F92844AF928] (general principles for transfers);

F929 (e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Definitions used in Schedule 2, paragraph 26 2

the listed GDPR provisions

1 In this Part of this Schedule, “the listed GDPR provisions” means—

(a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and

(b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR )—

(i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;

(ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Defined in Sch.2 para.1 · see it in the full Act

18 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (c).

Defined in Sch.2 para.18 · see it in the full Act

6 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d) Article 16 (right to rectification);

(e) Article 17(1) and (2) (right to erasure);

(f) Article 18(1) (restriction of processing);

(g) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(h) Article 20(1) and (2) (right to data portability);

(i) Article 21(1) (objections to processing);

(j) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).

Defined in Sch.2 para.6 · see it in the full Act
the affirmative resolution procedure

(7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

Defined in s.182(7) · see it in the full Act

Cases considering Schedule 2, paragraph 26 5

Dale Vince v Associated Newspapers Limited

[2026] EWCA Civ 899 · 15 July 2026

Confirms that the journalism exemption extends beyond pre-publication activities. Holds it unavailable because there was no evidence of the necessary incompatibility belief and no sustainable reasonable belief that the misleading presentation was in the public interest (see paras [73]–[75]). Applies the conditions that processing be undertaken with a view to journalistic publication and that the controller reasonably believe publication is in the public interest. Finds the public interest condition incapable of satisfaction for the misleading juxtaposition (see paras [74]–[75]). Holds that, having regard to the Editors’ Code of Practice, the controller could not reasonably believe that publishing the misleading headline alongside the photographs was in the public interest. The journalism exemption was therefore unavailable (see para [75]). Requires a reasonable belief that applying the relevant processing principles would be incompatible with journalism. Finds no evidence that anyone at the publisher held that belief concerning the fairness requirement (see paras [74]–[75]). Applies the requirement to have regard to the relevant code when assessing the reasonableness of a public interest belief. The Editors’ Code’s standards on misleading information prevented reliance on the journalism exemption (see paras [74]–[75]). Identifies the Editors’ Code of Practice as a code relevant to the mandatory assessment of a reasonable public interest belief. Uses its standards to reject reliance on the journalism exemption (see paras [74]–[75]).

John Alexander Melvin Hemming v Sonia Vanessa Poulton

[2021] EWHC 3863 (KB) · 15 June 2021

Provides the journalism special-purpose exemption from specified GDPR provisions where processing is for publication, the controller reasonably believes publication is in the public interest, and application of the provisions would be incompatible with journalism. The defence remained arguable (see paras [95]-[100]).

Joseph Pacini & Anor v Dow Jones & Company Inc.

[2024] EWHC 2714 (KB) · 29 October 2024Limits

The court noted the journalism exemption as a potential mechanism relevant to the wider claim, but did not determine its application on the preliminary issues. (see para [55])

What each judgment says about Schedule 2, paragraph 26 is in the case-law panel in the full Act.

Amendments and notes

10 notes from legislation.gov.uk

Amendments

  1. F922Words in Sch. 2 para. 26(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F923Words in Sch. 2 para. 26(9)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F924Words in Sch. 2 para. 26(9)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F925Words in Sch. 2 para. 26(9)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F926Word in Sch. 2 para. 26(9)(c)(ii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  6. F927Words in Sch. 2 para. 26(9)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F928Word in Sch. 2 para. 26(9)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 24 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  8. F929Sch. 2 para. 26(9)(e) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I297Sch. 2 para. 26 in force at Royal Assent for specified purposes, see s. 212(2)(f) text for certain specified purposes only, see the commentary.
  2. I298Sch. 2 para. 26 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)