Exemptions

Whilst the Data Protection Act applies generally to everyone, there are some exemptions to take into account special circumstances.

If you are exempt, you will not need to register with the ICO, do not have to grant subject access and can share data with third parties.

Businesses that may be exempt from the Act include:

• Some not-for-profit organisations.
• Organisations that do not use a computer.
• Organisations using data solely for administration, personal records or advertising in relation to their own business.

Entitlement to an exemption depends on your purpose for processing the specific personal data. Each case must be considered individually and you should never assume that your data processing is exempt.

Examples of individual exemptions include:

• If you need to disclose data in order to prevent a crime or assist the prosecution of offenders.
• Regulatory bodies that protect people or charities, as overseen by the law, do not need to disclose subject information.
• If information is required to be disclosed by law, such as in court, then an individual’s objection would be overridden by legal requirement.
• Confidential references given in relation to education, training or employment cannot be provided to an individual under a subject access request.

This list of exemptions is not exhaustive and is included in the Act to deal with specific, individual circumstances.
For more information on exemptions, go to the ICO website at:https://ico.org.uk/for-organisations/guide-to-data-protection/exemptions/