A routine compliance response can cause real harm here. That is exactly why this exemption exists, and why it is treated differently from most other DSAR exemptions.
This guide explains how the DSAR health and social care exemption works, and how ProvePrivacy’s DSAR Redaction Tool supports a safe, evidenced assessment.
What is the DSAR health and social care exemption?
The DSAR health and social care exemption is the set of rules in Schedule 3 of the Data Protection Act 2018 that restricts access across four data categories: health data, social work data, education data, and child abuse data.
Three of the four, health, social work and education data, share a “serious harm” test. Child abuse data uses a different standard: the “best interests of the child” test. Knowing which test applies to which category is the first step in any assessment.
What is the serious harm test?
For health, social work and education data, disclosure can be withheld where it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
This is a genuinely high bar. It is about protecting people from real harm, not shielding an organisation from an uncomfortable conversation or a difficult disclosure. A vague concern about upset is not enough to meet the test.
Why is the child abuse data test different?
Child abuse data uses the “best interests of the child” test instead of the serious harm test. Where disclosure would not be in the best interests of the child concerned, the data can be withheld.
This reflects the different, protective purpose of records relating to a child rather than an adult data subject. The test asks what serves the child’s welfare, not what causes measurable harm.
Why is the DSAR health and social care exemption different from other exemptions?
Most DSAR exemptions protect a process — an investigation, a negotiation, a regulatory function. This one is different. It protects a person.
The exemption exists to prevent a routine compliance response from causing genuine harm to the data subject, or to someone else named in the record. It is not there to protect the organisation’s own interests.
In practice, this often means health or social work professionals need to be involved in the decision. The serious harm test frequently requires a clinical or professional judgement that a data protection team cannot safely make alone.
A practical example of the DSAR health and social care exemption
Consider a care provider handling a SAR from a service user with a complex mental health history. The case file includes clinical notes, a social work assessment, and a record referencing a historic child protection concern about a family member.
The clinical notes and social work assessment need the serious harm test, ideally with a clinician or social worker involved in the decision, not just the data protection team alone. The child protection record needs the separate best-interests-of-the-child test, applied to that specific child, not the adult requester.
Withholding the whole file on a general “sensitive data” basis would not be defensible. Each category needs its own test, applied by someone qualified to judge the risk of harm.
Frequently asked questions about the DSAR health and social care exemption
Does the serious harm test apply to all four data categories? No. It applies to health, social work and education data. Child abuse data uses the separate best-interests-of-the-child test instead.
Is a vague concern about upset enough to withhold data? No. The serious harm test is a genuinely high bar. It requires a likelihood of serious harm to physical or mental health, not general discomfort.
Who should assess the serious harm test? Ideally a health or social work professional, since the test often requires a clinical or professional judgement the data protection team cannot safely make alone.
Does this exemption protect the organisation or the individual? The individual. Unlike most DSAR exemptions, which protect an organisational process, this one exists to prevent harm to the data subject or another person named in the record.
Key takeaways on the DSAR health and social care exemption
- The exemption covers four categories: health, social work, education, and child abuse data.
- Health, social work and education data share the serious harm test; child abuse data uses a different test.
- The serious harm test is a genuinely high bar — vague concern about upset is not enough.
- This exemption protects people, not organisational processes, unlike most other DSAR exemptions.
- Involve a health or social work professional in the decision wherever the judgement calls for it.
Why getting the DSAR health and social care exemption right matters
Care providers, schools and social work teams handle some of the most sensitive personal data an organisation can hold. Getting this exemption wrong in either direction carries genuine risk. Under-protecting a vulnerable individual can cause real harm. Over-withholding routine records denies people their statutory right of access for no good reason.
A consistent process, with the right professional involved at the right point, gives the organisation confidence that every decision was made on the correct test, and can be evidenced if it is ever challenged.
Manual assessment vs a structured DSAR redaction tool
| Factor | Manual, ad hoc assessment | ProvePrivacy DSAR Redaction Tool |
|---|---|---|
| Applying the correct test per category | Easy to confuse serious harm with best interests of the child | Structured exemption library keeps each test separate |
| Recording professional sign-off | Often informal or missing | Documented decision and rationale per redaction |
| Consistency across case files | Relies on one reviewer’s judgement | Structured workflow applies the same test across every document |
How does ProvePrivacy help with the DSAR health and social care exemption?
ProvePrivacy is the affordable GDPR compliance software built for data protection teams in resource-constrained, mid-market organisations. It’s a genuine OneTrust alternative, with all modules included and unlimited users.
Its DSAR management software includes a built-in DSAR Redaction Tool, available as standard to every client. It keeps the serious harm and best-interests-of-the-child tests clearly separated, with a documented rationale for every decision.
Book a demo today to see how ProvePrivacy’s RoPA, risk, incident and DSAR modules work together in one governed platform.