Of all the exemptions in the Data Protection Act 2018, this group carries the highest risk of a wrong call. Most exemptions exist to protect the organisation. These exist to protect a person: a patient, a child, a vulnerable adult, someone at risk. Get the assessment wrong in either direction and the consequence is real.

This guide walks through the four statutory tests set out in Schedule 3 of the Act, each with its own evidence requirements:

• Health data — when the serious harm test applies, and why you need a current, written opinion from an appropriate health professional before you rely on it.
• Social work data — the same test, tailored to social work, plus a separate carve-out for information shared in confidence, common in child protection contexts.
• Education data — how the test applies to pupil records, and where a second, narrower restriction can also come into play.
• Child abuse data — the narrowest exemption in the schedule, governed by a best interests test rather than the serious harm test.

Written for data protection officers and privacy managers handling subject access requests across health, social care, education and safeguarding, the guide sets out what each test requires, the most common pitfall, and how to document your reasoning before the clock runs out.

Download the guide below.