Data Protection Act 2018, section 15

Exemptions etc

PART 2 General processing

(1)Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the [F65UK GDPRF65] .

(2)In Schedule 2—

(a)Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the [F66UK GDPRF66] in specified circumstances [F67(of a kind described inF67] Article 6(3) and Article 23(1) of the [F68UK GDPR)F68] ;

(b)Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the [F69UK GDPRF69] in specified circumstances [F70(of a kind described inF70] Article 23(1) of the [F71UK GDPR)F71] ;

(c)Part 3 makes provision restricting the application of Article 15 of the [F72UK GDPRF72] where this is necessary to protect the rights of others [F73(of a kind described inF73] Article 23(1) of the [F74UK GDPR)F74] ;

(d)Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the [F75UK GDPRF75] in specified circumstances [F76(of a kind described inF76] Article 23(1) of the [F77UK GDPR)F77] ;

(e)Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV [F78and V of the UK GDPRF78] for reasons relating to freedom of expression [F79(of a kind described in Article 85(2) of the UK GDPR)F79] ;

(f)F81Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the [F80UK GDPRF80] for scientific or historical research purposes, statistical purposes and archiving purposes ....

(3)Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the [F82UK GDPRF82] to health, social work, education and child abuse data [F83(of a kind described inF83] Article 23(1) of the [F84UK GDPR)F84] .

(4)Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the [F85UK GDPRF85] to information the disclosure of which is prohibited or restricted by an enactment[F86 (of a kind described inF86] Article 23(1) of the [F87UK GDPR)F87] .

[F88 (4A)In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).F88]

(5)In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part [F89(sections 26 to 28)F89] .

Definitions used in section 15 1

enactment

“enactment” includes—

(a)

an enactment passed or made after this Act,

(b)

an enactment comprised in subordinate legislation,

(c)

an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,

(d)

an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...

(e)

an enactment comprised in, or in an instrument made under, Northern Ireland legislation; and

(f)

any assimilated direct legislation;

Defined in s.205(1) · see it in the full Act

Cases considering section 15 5

Johnson v Secretary of State for the Home Department

[2020] EWCA Civ 1032 · 6 August 2020Limits

Section 15 was identified as part of the statutory mechanism restricting GDPR rights. (see para [44])

Michael Ashley v The Commissioners for HMRC

[2025] EWHC 134 (KB) · 24 January 2025

Confirms that Schedule 2 restricts UK GDPR provisions in the circumstances described by Article 23(1). It supplied the statutory basis for the exemptions (see para [68]). Confirms the statutory mechanism by which Schedule 2 restricts the listed UK GDPR provisions. It was not separately applied beyond identifying the legislative framework (see para [68]).

the3million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor

[2023] EWHC 713 (Admin) · 29 March 2023

Links the statutory exemptions in Schedules 2 to 4 to the Article 23 power to restrict UK GDPR rights. (see para [13])

What each judgment says about section 15 is in the case-law panel in the full Act.

Amendments and notes

26 notes from legislation.gov.uk

Amendments

  1. F65Words in s. 15(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F66Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F67Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F68Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F69Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F70Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F71Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F72Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  9. F73Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  10. F74Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  11. F75Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  12. F76Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  13. F77Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  14. F78Words in s. 15(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  15. F79Words in s. 15(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  16. F81Words in s. 15(2)(f) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(8)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  17. F80Words in s. 15(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(8)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  18. F82Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  19. F83Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  20. F84Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  21. F85Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  22. F86Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  23. F87Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  24. F88S. 15(4A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(11) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  25. F89Words in s. 15(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(12) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I16S. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)