DPA 2018 Schedule 2 Part 5 Paragraph 26 — The Journalism Exemption

Overview

Article 85 of UK GDPR requires UK law to reconcile the right to data protection with the right to freedom of expression and information, including processing for journalistic, academic, artistic, and literary purposes. The UK's mechanism for doing so is found in Data Protection Act 2018 Schedule 2 Part 5 Paragraph 26, read alongside section 174 of the Act.

Together these provisions create what is commonly called the “journalism exemption” or the “special purposes” exemption. Where it applies, it allows a controller — whether a national newspaper, a local outlet, a freelance journalist, or an academic researcher — to process personal data for journalism and related purposes while disapplying certain UK GDPR provisions that would otherwise require transparency, access, correction, or deletion.

The “special purposes” covered by the exemption are: journalism; academic, artistic, and literary purposes. In practice, the exemption is most commonly relied upon by journalists and publishers, but researchers and documentary filmmakers also invoke it regularly.

The exemption is not a blanket immunity. It must be applied provision by provision to each specific UK GDPR right or principle a journalist seeks to disapply. Data security obligations and the duty to report data breaches to the ICO are not affected by the exemption.

What UK GDPR provisions the exemption can disapply

Where all four conditions are satisfied for a specific piece of processing, Paragraph 26 can disapply the following UK GDPR provisions:

• ›Article 5(1)(a) — the principles of lawfulness, fairness, and transparency
• ›Article 5(1)(b) — the purpose limitation principle
• ›Article 5(1)(c) — the data minimisation principle
• ›Article 5(1)(e) — the storage limitation principle
• ›Articles 13 and 14 — the right to be informed (privacy notices)
• ›Article 15 — the right of access (Subject Access Requests)
• ›Article 16 — the right to rectification
• ›Article 17 — the right to erasure (right to be forgotten)
• ›Article 18 — the right to restriction of processing
• ›Article 21 — the right to object to processing
• ›Article 22 — rights related to automated decision-making and profiling

Provisions that are not disapplied include: the security principle (Article 5(1)(f)), the accountability principle (Article 5(2)), the data breach notification duties (Articles 33 and 34), and the obligation to maintain records of processing activities (Article 30). These remain in full force regardless of any journalism exemption claim.

The “reasonably believes” test

The phrase “reasonably believes” appears in both conditions B and C. The courts and the ICO have interpreted it as a combined subjective and objective standard. The journalist must:

• ›Actually hold the relevant belief at the time of processing (the subjective element).
• ›Hold a belief that a reasonable journalist in their position could genuinely hold (the objective element).
• ›Be able to demonstrate that the belief existed contemporaneously — notes, sign-off records, and editorial assessments created at the time carry far more weight than reconstructed justifications made after a complaint arrives.

The ICO's journalism guidance indicates it will have regard to any relevant code of practice when assessing whether a belief is reasonable. Relevant codes include those issued by the Independent Press Standards Organisation (IPSO), Impress, and Ofcom. Compliance with an applicable code supports a reasonable belief argument; a departure from a code without explanation weakens it.

Editorial judgement is given real weight. Where an experienced editor has applied their mind to the public interest rationale and documented that reasoning, courts are generally reluctant to second-guess genuine editorial decisions. The exemption is not designed to be applied mechanically; proportionality matters.

When the ICO will reject a journalism exemption claim

The ICO does not accept every journalism exemption claim. The following patterns are most likely to result in a rejection:

• ⚠Publication has already occurred and the personal data is simply being retained without any ongoing editorial purpose. The exemption covers processing undertaken with a view to publication; once published, continued indefinite retention needs separate justification.
• ⚠The exemption is claimed pre-emptively to defeat a SAR where no genuine editorial work has begun or where the investigation was abandoned. A nominal or speculative editorial purpose will not suffice.
• ⚠The controller cannot articulate a specific public interest rationale. A general assertion that journalism serves the public interest is insufficient; the specific story must serve a specific public interest.
• ⚠The claim is made wholesale, without a provision-by-provision analysis of which specific UK GDPR rights or principles are being disapplied and why compliance with each would be incompatible.
• ⚠The personal data involved is special category data and no Schedule 1 condition has been identified or applied.
• ⚠The journalist or publication is not subject to, or does not follow, a relevant code of practice, weakening the reasonableness of their editorial judgement claim.

Practical guidance

Maintaining a data protection file for each investigation is best practice and provides the evidence base needed to defend an exemption claim before the ICO or a court. The file should record:

• ›A description of the personal data being processed and its sensitivity level (standard or special category).
• ›The special purpose for which the data is being processed and the intended publication.
• ›A written contemporaneous assessment of why publication is in the public interest, signed off by an editor or senior journalist.
• ›A provision-by-provision record of which UK GDPR rights and principles the exemption is being applied to disapply, and why compliance with each would undermine the journalism.
• ›The applicable regulatory code (IPSO Editors' Code, Impress Standards Code, Ofcom Broadcasting Code) and the relevant clauses.
• ›Any Subject Access Requests received, the response given, and the reasoning for withholding information under the exemption.
• ›Details of any data security measures applied to source materials, notes, and recordings.
• ›A retention schedule: when will each category of data be reviewed and, where no longer needed, deleted.

If your publication has a Data Protection Officer (DPO), involve them early. The DPO can help structure the public interest assessment and ensure the provision-by-provision analysis is properly documented. For freelance journalists without access to an in-house DPO, the NUJ and specialist media law firms can advise on data protection compliance frameworks suited to freelance work.

Source protection, confidential information, and the right to privacy

The journalism exemption under DPA 2018 does not operate in isolation. It sits within a wider legal framework that includes the Article 8 ECHR right to private life, the law of confidence, and the statutory source protection provisions under the Contempt of Court Act 1981 (as amended).

The leading case on the tension between privacy and freedom of expression is Campbell v MGN Ltd [2004] UKHL 22. The House of Lords established that where private information is disclosed, the court must conduct a proportionality balancing exercise: the individual's Article 8 rights are weighed against the publisher's Article 10 (freedom of expression) rights. The same proportionality exercise applies when a court or the ICO assesses whether the journalism exemption has been properly invoked.

Key points from the Article 8/10 balancing exercise as applied to data protection:

• ›The privacy of individuals who have not entered public life, or who are only tangentially connected to a story, attracts strong protection.
• ›Public figures retain a private sphere; their exercise of their public functions is fair game, but their medical history, sexual lives, and family members ordinarily are not — unless directly relevant to the public interest story.
• ›The fact that information is already in the public domain in some form does not automatically extinguish a data subject's rights; the manner, context, and prominence of republication all matter.
• ›Source confidentiality is a separate but related concern: material that could identify a confidential source should be subject to enhanced security and should not be disclosed in response to a SAR where the journalism exemption applies to that material.

For more on source protection and the interaction between data protection and confidentiality law, see our guide on Source Protection. For the public interest test applied in other media law contexts, see Public Interest Defence.

Frequently asked questions