This guide covers the SAR exemptions for health, social care work, education and child abuse data under the Data Protection Act 2018.
A subject access request touches a patient’s medical file, a child’s safeguarding record, or a pupil’s education file. Do you release everything, or does disclosure risk causing real harm to the person it’s about? This is exactly where the SAR exemptions for health, social work, education and child abuse data come in, and this group carries more risk than any other exemption in the series, because it protects individuals, not your organisation.
Schedule 3 of the Data Protection Act 2018 restricts the right of access across four separate data categories, and three of them share a common threshold known as the serious harm test. The fourth, child abuse data, uses a narrower best interests of the child test instead. Getting the wrong call here doesn’t just risk a complaint, it can mean withholding information that would genuinely help someone, or disclosing information that causes real harm to a patient, a child or a vulnerable adult.
Why the health and social care data exemption is different
The SAR exemptions for health, social work, education and child abuse data exist to stop a routine compliance response from causing the very harm data protection law is meant to prevent. Unlike most exemptions in this series, the test here isn’t about protecting a process or an investigation, it’s about protecting a person, and for health data specifically, that judgement usually can’t be made by your organisation alone.
This guide walks through all four data categories, the evidence a non health professional needs before relying on the health exemption, and the pitfall that causes the most damage: applying the exemption on assumption rather than a current, documented professional opinion.
Once the right test has been applied, precise handling of what actually gets disclosed matters just as much. The ProvePrivacy platform’s DSAR Redaction Tool, included as standard for every client, is built to apply exemptions like these directly against a case, so sensitive health, social work, education or child protection data can be handled with the evidence trail a regulator would expect. Download the full guide below to see where the evidence requirements are strictest.