This guide explains how the DSAR legal professional privilege exemption works. It also covers the related self-incrimination exemption. And it explains how ProvePrivacy’s DSAR Redaction Tool helps apply it correctly.
What is the DSAR legal professional privilege exemption?
The DSAR legal professional privilege exemption protects personal data subject to legal advice privilege or litigation privilege. It applies to subject access requests. Unlike most Data Protection Act 2018 exemptions, it borrows its test from established case law. It does not use a bespoke prejudice standard.
What is legal advice privilege?
Legal advice privilege protects confidential communications between a client and their lawyer. This applies whether or not litigation is contemplated.
A communication is very likely privileged if three things are true. It is confidential. It is between a client and a lawyer acting in a professional legal capacity. It concerns the giving or receiving of legal advice.
What is litigation privilege, and how is it different?
Litigation privilege applies when litigation is in reasonable contemplation. It covers confidential communications created for the dominant purpose of that litigation. This includes communications with non-lawyers, such as witnesses or experts.
The Court of Appeal’s decision in SFO v Eurasian Natural Resources Corporation clarified the “reasonable contemplation” test. This matters for internal investigations that may lead to litigation or prosecution. It is not always obvious when litigation became reasonably in contemplation.
How does the self-incrimination exemption work alongside the DSAR legal professional privilege exemption?
A separate exemption applies where complying with a SAR would reveal evidence of an offence. This could expose the controller to proceedings for that offence. It does not cover proceedings under UK data protection law itself.
This is distinct from privilege. It is about the risk of self-incrimination, not the confidentiality of a legal communication. The two exemptions often relate to the same investigation. Each still needs its own separate assessment.
What goes wrong when the DSAR legal professional privilege exemption is misapplied?
The most common error is treating every communication that mentions a lawyer as automatically privileged. Privilege depends on the substance of the communication. It does not depend simply on whether a lawyer is copied in.
A second common error is claiming litigation privilege too early. Litigation must be genuinely in reasonable contemplation, not merely a theoretical possibility.
A practical example of the DSAR legal professional privilege exemption
Consider an organisation running an internal investigation into a whistleblowing complaint. Legal counsel is instructed once the complaint is escalated. The subject of the investigation later submits a SAR.
Emails seeking legal advice from counsel after instruction are very likely privileged. Interview notes taken before counsel was involved are not automatically privileged. This is true even if a lawyer later reviews them.
Litigation may later become reasonably in contemplation. If so, communications created for that dominant purpose may attract litigation privilege. This includes communications with external witnesses. Each document needs its own assessment. It should not rely on a blanket assumption based on who was copied into the email.
Frequently asked questions about the DSAR legal professional privilege exemption
Does copying a lawyer into an email automatically make it privileged? No. Privilege depends on the substance of the communication. It does not depend on who is copied in.
When does litigation privilege start to apply? Once litigation is in reasonable contemplation. The Eurasian Natural Resources Corporation case set out how that test should be applied.
Is the self-incrimination exemption the same as legal professional privilege? No. Self-incrimination is about the risk of exposing the controller to proceedings for an offence. Privilege is about the confidentiality of a legal communication. They need separate assessments.
Does the DSAR legal professional privilege exemption use a prejudice test? No. It borrows its test from established case law on legal advice and litigation privilege instead.
Key takeaways on the DSAR legal professional privilege exemption
- Privilege depends on the substance of a communication, not on whether a lawyer was copied in.
- Legal advice privilege applies whether or not litigation is contemplated. Litigation privilege needs reasonable contemplation.
- The self-incrimination exemption is separate from privilege. It needs its own assessment.
- This exemption borrows its test from case law, not the usual prejudice test used elsewhere.
- Assess each document on its own facts. Keep a documented rationale for every decision.
Why getting the DSAR legal professional privilege exemption right matters
Internal investigations often produce large volumes of correspondence. Some of it is genuinely privileged. Some is only loosely connected to legal advice. Over-claiming privilege risks an ICO complaint. It also undermines the requester’s statutory right of access.
Under-claiming it risks disclosing genuinely privileged material. This can prejudice the organisation’s legal position. A consistent, document-by-document process keeps both risks in check. It also gives the organisation a defensible record if challenged.
Training reviewers on the difference between legal advice privilege and litigation privilege reduces this risk further. It also helps teams recognise when the self-incrimination exemption needs a separate, additional assessment on the same document. A short internal checklist, covering all three tests, is often enough to keep decisions consistent across a busy legal or HR team handling several investigations at once.
Manual assessment vs a structured DSAR redaction tool
| Factor | Manual, ad hoc assessment | ProvePrivacy DSAR Redaction Tool |
|---|---|---|
| Distinguishing legal advice from litigation privilege | Relies on individual legal knowledge, case by case | Structured exemption library keeps each test separate |
| Evidencing “reasonable contemplation” of litigation | Rationale often undocumented | Documented decision and rationale per redaction |
| Separating privilege from self-incrimination | Easy to conflate two different tests | Structured workflow keeps both exemptions distinct |
How does ProvePrivacy help with the DSAR legal professional privilege exemption?
ProvePrivacy is the affordable GDPR compliance software built for data protection teams in resource-constrained, mid-market organisations. It’s a genuine OneTrust alternative. All modules are included, with unlimited users.
Its DSAR management software includes a built-in DSAR Redaction Tool, available as standard to every client. It keeps privilege and self-incrimination assessments clearly documented, with a rationale for every decision.
Book a demo today to see how ProvePrivacy’s RoPA, risk, incident and DSAR modules work together in one governed platform.