DSAR Exemptions: Legal Professional Privilege

This guide covers the SAR exemptions for legal professional privilege and self-incrimination under the Data Protection Act 2018.

An internal investigation is under way, and a subject access request lands in the middle of it. Does legal privilege protect the file, or does that depend on how close the matter is to actual litigation? This is exactly where the SAR exemptions for legal professional privilege and self-incrimination come in, and they work differently from almost every other exemption in this series, because they borrow directly from the courts rather than using the usual prejudice test.

Legal advice privilege protects confidential communications between a client and their lawyer, whether or not litigation is contemplated at all. Litigation privilege is wider in one sense, since it can cover communications with third parties such as expert reports, but narrower in another, since it only applies once litigation is in reasonable contemplation. Getting that distinction wrong, either by assuming privilege applies too early or missing it once it genuinely does, is where most errors in this group happen.

Why the legal privilege exemption follows the courts, not the prejudice test

The SAR exemptions for legal professional privilege and self-incrimination exist because Parliament decided the wider legal system shouldn’t be undermined by a data protection right. Applying them correctly means reasoning the way a court would when assessing disclosure in litigation, not the way a data protection officer normally assesses prejudice.

This guide covers both limbs of legal professional privilege, the reasonable contemplation test set out by the Court of Appeal in SFO v Eurasian Natural Resources Corporation, and self-incrimination, including the limits Parliament built in so it can never be used to dodge enforcement under the Data Protection Act itself.

Once privilege has been correctly assessed, separating what’s genuinely protected from the rest of a case file is the next step. The ProvePrivacy platform’s DSAR Redaction Tool, available to every client, is built to apply exemptions like these directly against a case, rather than defaulting to a blanket refusal. Download the full guide below to see exactly where reasonable contemplation begins.

Scroll to Top

Contact us

If you would like to ask more questions or to arrange training, complete the form below and we will respond shortly.

Prefer to schedule a 15 minute call? Schedule call today >>

See our Privacy Statement for more details.