Data Protection Act 2018

[F1 45A Exemption from sections 44 and 45: legal professional privilege U.K.

(1) Sections 44(2) and 45(1) do not require the controller to give the data subject—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

(2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

(a) the decision to rely on the exemption,

(b) the reason for the decision,

(c) the data subject’s right to make a request to the Commissioner under section 51,

[F2 (ca) the data subject’s right to make a complaint to the controller under section 164A,]

(d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and

(e) the data subject’s right to apply to a court under section 167.

(3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

(a) undermine a claim described in subsection (1)(a), or

(b) conflict with a duty described in subsection (1)(b).

(4) The controller must—

(a) record the reason for a decision to rely on the exemption in subsection (1), and

(b) if requested to do so by the Commissioner, make the record available to the Commissioner.

(5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).]

Textual Amendments

F1 S. 45A inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(6), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

F2 S. 45A(2)(ca) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 12; S.I. 2026/82, reg. 3(b) (with reg. 7)