- Latest available (Revised)
- Original (As enacted)
Freedom of Information Act 2000, Section 40 is up to date with all changes known to be in force on or before 11 September 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.
(1)Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2)Any information to which a request for information relates is also exempt information if—
(a)it constitutes personal data which [F1does] not fall within subsection (1), and
(b)[F2the first, second or third] condition below is satisfied.
[F3(3A)The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B)The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the [F4UK GDPR] (general processing: right to object to processing).]
[F5(4A)The third condition is that—
(a)on a request under Article 15(1) of the [F6UK GDPR] (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.]
[F7(5A)The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).
(5B)The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—
(a)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—
(i)would (apart from this Act) contravene any of the data protection principles, or
(ii)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded;
(b)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the [F8UK GDPR] (general processing: right to object to processing);
(c)on a request under Article 15(1) of the [F9UK GDPR] (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);
(d)on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.]
F10(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[F11(7)In this section—
“the data protection principles” means the principles set out in—
Article 5(1) of the [F12UK GDPR], and
section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
F13...
[F14“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).]
(8)In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the [F15UK GDPR] would be contravened by the disclosure of information, Article 6(1) of the [F15UK GDPR] (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.]
Textual Amendments
F1Words in s. 40(2)(a) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(2)(a) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
F2Words in s. 40(2)(b) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(2)(b) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
F3S. 40(3A)(3B) substituted for s. 40(3) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(3) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
F4Words in s. 40(3B) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
F5S. 40(4A) substituted for s. 40(4) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(4) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
F6Words in s. 40(4A)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
F7S. 40(5A)(5B) substituted for s. 40(5) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(5) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
F8Words in s. 40(5B)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
F9Words in s. 40(5B)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
F10S. 40(6) omitted (25.5.2018) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(6) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
F11S. 40(7)(8) substituted for s. 40(7) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(7) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
F12Words in s. 40(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(3)(a) (with Sch. 3 para. 112)
F13Words in s. 40(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(3)(b) (with Sch. 3 para. 112)
F14Words in s. 40(7) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(3)(c) (with Sch. 3 para. 112)
F15Words in s. 40(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(4) (with Sch. 3 para. 112)
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Text created by the government department responsible for the subject matter of the Act to explain what the Act sets out to achieve and to make the Act accessible to readers who are not legally qualified. Explanatory Notes were introduced in 1999 and accompany all Public Acts except Appropriation, Consolidated Fund, Finance and Consolidation Acts.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: