Guide to Data Protection Act for Data Controllers



What is exempted?

This exemption applies to an educational record if its disclosure to the data subject would be likely to cause serious harm to the physical or mental health or condition of that individual or any other person.

An educational record includes information about whether the data subject who is a child is or has been subject to abuse, or may be at risk of it.

An educational record also includes an exam or test question that is likely to be used within the next twelve months.

“Abuse” in relation to a child: 

(a) includes physical injury to and physical neglect, emotional neglect, ill-treatment and sexual abuse of the person; and

(b) excludes accidental injury.  

What provisions in the DPA does the exemption relate to?

Under this exemption personal data is exempt from:

  • section 8 (the access right). 

When does the exemption apply?

The personal data must be an educational record and its disclosure must be likely to cause serious harm to the mental or physical health or condition of an individual. 

What else is there to consider?

If the request for access is made by a parent or a legal guardian (appointed by the court to manage the affairs of the child) on behalf of the child, personal data relating to actual or potential abuse of the child is exempt from section 8 (the right to access), but only to the extent that disclosure would not be in the interests of the child. 

Relevant provisions

Data Protection Act (2021 Revision)

Section 20: Exemption relating to health, education or social work                                                                                 

Data Protection Regulations, 2018:

Regulation 8: Exemption relating to education                                                                           

Previous Next