Exemptions
-
The Data (Use and Access) Act 2026 got Royal Assent on 19 June 2025. All the provisions affecting data protection law and the Privacy and Electronic Regulations Communications are now in force. The Department for Science and Innovation (DSIT) has set out the commencement plans. You can find more details on the Gov.uk website.
The guidance on this page is suitable for large businesses in the public, private and third sectors. Small businesses should use the resources on our small business web hub.
Brief guidance
A guide to the data protection exemptions
Data protection exemptions, how they work and a list of available exemptions.
Detailed guidance
Immigration exemption: a guide
The immigration exemption, when and how to apply it, how it impacts individual rights and what happens when an immigration investigation becomes a criminal investigation.
National security and defence: a guide
The national security and defence exemption, how the exemption works and when to apply it, ministerial certificates, special rules for special category data, security obligations and law enforcement processing.
Resources
Training videos: Exemptions
Recordings of ICO staff training on data protection exemptions, available for you to reuse.