Last reviewed: Next review due:
What the journalism exemption actually does
UK GDPR and the Data Protection Act 2018 regulate how organisations process personal data. In principle, that includes journalists processing names, addresses, financial records, medical details, and other information about identifiable individuals. Without any carve-out, much of investigative journalism would be impossible.
Section 174 of the Data Protection Act 2018, read with Schedule 2, Part 5, paragraph 26, creates the “special purposes” exemption. Where it applies, it disapplies most UK GDPR data subject rights and most of the data protection principles — so a person cannot stop you processing their data simply because they object, and you are not required to be transparent about your processing in the normal way.
“In this Part, "the special purposes" means one or more of the following—”
The exemption is not a free pass. It must be applied to each individual processing activity. It cannot be invoked retrospectively. And some obligations — most importantly data security and data breach reporting — remain regardless.
When this matters
The journalism exemption becomes relevant whenever you:
- Process personal data about a private individual who has not consented to being investigated.
- Receive a Subject Access Request (SAR) from someone you are investigating or have reported on.
- Are served with an erasure or rectification request asking you to remove published material.
- Receive a complaint to the ICO from a subject who alleges you have breached their data protection rights.
- Are considering whether to rely on leaked, hacked, or scraped personal data for a story.
- Retain notes, recordings, or source materials containing identifiable personal information.
The three-limb test
All three conditions must be satisfied simultaneously for the exemption to apply to any given processing activity:
- 1Processing with a view to publication. The data must be processed with the specific purpose of publishing journalistic material. Internal research notes, tip-off logs, and interview recordings qualify if they feed into publication.
- 2Reasonable belief that publication serves the public interest.You must genuinely and reasonably believe the story serves the public interest. “Public curiosity” is not the same as “public interest.” Document this belief contemporaneously.
- 3Reasonable belief that compliance with the specific data protection provision is incompatible with the journalism purpose. This is a limb-by-limb analysis. You cannot simply invoke the exemption wholesale. You must consider each right or principle you are seeking to disapply and why complying with it would undermine your journalism.
Red flags
- You cannot identify a clear public interest beyond reader interest or entertainment value.
- The personal data relates to a private individual with no public role and no relevant wrongdoing.
- You have not applied the exemption specifically to each data protection provision you are seeking to disapply.
- You are retaining personal data far longer than the story requires without reviewing whether retention remains necessary.
- You have suffered a data breach involving personal data gathered for journalism and have not notified the ICO within 72 hours.
- A SAR has arrived and you have simply ignored it rather than responding and invoking the exemption formally.
- The material involves special category data (health, sexual life, religion, ethnicity) and you have no heightened justification.
- You are processing the personal data of children without additional safeguards in place.
Pre-publication data protection checklist
- Identified the specific personal data being processed and its sensitivity level.
- Confirmed the story is being prepared with a view to publication.
- Recorded in writing why I reasonably believe publication serves the public interest.
- Identified which specific UK GDPR rights/principles the exemption needs to disapply for this story.
- Confirmed that compliance with those provisions would genuinely undermine the journalism.
- Applied appropriate security to source materials, notes, and recordings.
- Checked whether retention of any data beyond publication is necessary; deleted what is not.
- Prepared a draft response to any potential SAR explaining (in general terms) why the exemption applies.
- Consulted the ICO Data Protection and Journalism Code (2024) for guidance on any sensitive processing.
- Noted the data protection reasoning in the editorial file alongside the public interest reasoning.
Track your data protection reasoning
Use the Risk Register to create a documented record of your data protection and public interest reasoning before publication. This is your evidence if the ICO or a court later scrutinises whether the exemption was properly applied.
Open Risk Register →Common mistakes
- Treating the exemption as a blanket shield rather than a limb-by-limb analysis applied to specific provisions.
- Not documenting the public interest reasoning until after a complaint arrives — courts and the ICO look at what you believed at the time of processing.
- Ignoring SARs entirely. You must respond within one month even if you are withholding information under the exemption.
- Assuming the exemption covers data security. It does not: you must still keep materials secure.
- Failing to report a data breach because of a mistaken belief that the journalism exemption covers breach notification.
- Retaining source materials indefinitely when the story has been published and further retention cannot be justified.
- Assuming that because a story is true or publicly interesting, the exemption automatically applies without satisfying limb three.
Related guides
Public Interest Defence
The s.4 DA 2013 defence and how to document reasonable belief before publication.
Source Protection
Legal protections for source confidentiality and digital security.
UK GDPR for Journalists
Broader guide to lawful bases, SARs, and your data protection obligations.
Right of Reply
Giving subjects an opportunity to comment before publication.
Primary sources
Frequently asked questions
Does the journalism exemption mean journalists are outside GDPR entirely?
No. The exemption disapplies specific rights and principles when the three-limb test is met, but security obligations, accountability, and data breach reporting still apply. It is a qualified exemption applied case-by-case, not a blanket exclusion from data protection law.
Can a subject of an investigation demand to see my notes under a SAR?
Not automatically. Where the journalism exemption applies, you can refuse or restrict a SAR. However, you must still respond to the SAR within one month and explain (in general terms) why you are withholding the information. Keep a record of your reasoning.
What counts as "public interest" for the purposes of the exemption?
The ICO and courts look at whether the subject matter is genuinely of legitimate public concern — exposing wrongdoing, holding power to account, informing public debate. Personal curiosity or entertainment value alone is unlikely to suffice. Editors should record their public interest reasoning contemporaneously.
Do I still have to report a data breach even if I am relying on the journalism exemption?
Yes. The exemption does not disapply the data breach notification duties under UK GDPR Articles 33 and 34. If a breach is likely to result in risk to individuals, you must notify the ICO within 72 hours and, where the risk is high, notify affected individuals.
Does the exemption cover photojournalists and video journalists?
Yes, provided the processing of images or footage is with a view to publication and meets the three-limb test. Images of identifiable individuals are personal data. The key question is whether publishing serves a genuine public interest and whether data protection compliance would be incompatible with that purpose.
What is the ICO Data Protection and Journalism Code?
It is a statutory code of practice issued by the ICO under DPA 2018 s.174(4), updated in 2024. It sets out how journalists and news organisations should handle personal data responsibly, and courts and the ICO must take it into account when deciding whether the exemption applies.