Data Protection Act 2018, Schedule 2, paragraph 5

Information required to be disclosed by law etc or in connection with legal proceedings

SCHEDULE 2 Exemptions etc from the UK GDPR

5 (1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.

(2) The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.

(3) The listed GDPR provisions do not apply to personal data where disclosure of the data—

(a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights,

to the extent that the application of those provisions would prevent the controller from making the disclosure.

Definitions used in Schedule 2, paragraph 5 4

the listed GDPR provisions

1 In this Part of this Schedule, “the listed GDPR provisions” means—

(a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and

(b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR )—

(i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;

(ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Defined in Sch.2 para.1 · see it in the full Act

18 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (c).

Defined in Sch.2 para.18 · see it in the full Act

6 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d) Article 16 (right to rectification);

(e) Article 17(1) and (2) (right to erasure);

(f) Article 18(1) (restriction of processing);

(g) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(h) Article 20(1) and (2) (right to data portability);

(i) Article 21(1) (objections to processing);

(j) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).

Defined in Sch.2 para.6 · see it in the full Act
enactment

“enactment” includes—

(a)

an enactment passed or made after this Act,

(b)

an enactment comprised in subordinate legislation,

(c)

an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,

(d)

an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...

(e)

an enactment comprised in, or in an instrument made under, Northern Ireland legislation; and

(f)

any assimilated direct legislation;

Defined in s.205(1) · see it in the full Act
tribunal

“tribunal” means any tribunal in which legal proceedings may be brought;

Defined in s.205(1) · see it in the full Act
the Tribunal

“the Tribunal”, in relation to an application or appeal under this Act, means—

(a)

the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, or

(b)

the First-tier Tribunal, in any other case.

Defined in s.205(1) · see it in the full Act

Cases considering Schedule 2, paragraph 5 3

Johnson v Secretary of State for the Home Department

[2020] EWCA Civ 1032 · 6 August 2020Limits

Paragraph 5 was identified as the restriction concerning information required in connection with legal proceedings. (see para [44]) Paragraph 5(3) permitted disclosure where necessary for legal proceedings or for establishing, exercising or defending legal rights, to the extent required to avoid preventing disclosure. (see paras [45]-[47])

Yesim Kul & Ors v DWF Law LLP

[2025] EWHC 1824 (KB) · 22 July 2025Disapplies

The court held that purpose limitation and related information rights did not prevent necessary disclosure for establishing, exercising or defending legal rights.

CJ v Secretary of State for the Home Department

[2019] UKUT 126 (IAC) · 8 March 2019

The exemption for disclosure necessary for, or in connection with, legal proceedings restricted the appellant’s data-subject rights to the extent needed for the appeal. The Tribunal held the provision compatible with GDPR Article 23 (see paras [37]-[38]). The exemption for disclosure otherwise necessary to establish, exercise or defend legal rights restricted the appellant’s data-subject rights to the extent needed for the appeal. The Tribunal held the provision compatible with GDPR Article 23 (see paras [37]-[38]).

What each judgment says about Schedule 2, paragraph 5 is in the case-law panel in the full Act.

Amendments and notes

1 notes from legislation.gov.uk

Commencement

  1. I276Sch. 2 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)