http://www.legislation.gov.uk/ukpga/2018/12/section/45AData Protection Act 2018An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner's functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.texttext/xmlenStatute Law Database2026-07-09Expert Participation2026-06-19 Data Protection Act 2018s. 26(2)(f)(ai)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(4)reg. 1(2)Data Protection Act 2018s. 45A(2)(c)(d)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(2)Data Protection Act 2018s. 45A(4)(b)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(2)Data Protection Act 2018s. 160(4)(ab)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(2)Data Protection Act 2018Sch. 7 para. 51AThe Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(12)(a)reg. 1(2)Data Protection Act 2018Sch. 3 para. 8(1)(y)Adoption and Children Act (Northern Ireland) 2022Sch. 3 para. 78(3)s. 160(1) PART 3CHAPTER 345A1Sections 44(2) and 45(1) do not require the controller to give the data subject—ainformation in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, orbinformation in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.2A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—athe decision to rely on the exemption,bthe reason for the decision,cthe data subject’s right to make a request to the Commissioner under section 51,cathe data subject’s right to make a complaint to the controller under section 164A,dthe data subject’s right to lodge a complaint with the Commissioner under section 165, andethe data subject’s right to apply to a court under section 167.3Subsection (2)(a) and (b) do not apply to the extent that complying with them would—aundermine a claim described in subsection (1)(a), orbconflict with a duty described in subsection (1)(b).4The controller must—arecord the reason for a decision to rely on the exemption in subsection (1), andbif requested to do so by the Commissioner, make the record available to the Commissioner.5The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).S. 45 cross-heading omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 79(5), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)S. 45A inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(6), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)S. 45A(2)(ca) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 12; S.I. 2026/82, reg. 3(b) (with reg. 7)