Freedom of Information Act 2000FOIAUK · 2000 c. 36
Digiphile
Freedom of Information Act 2000 (c. 36) – Section 40 – Personal information.

Sections

Section 40Personal information.

(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
  • (a)
    it constitutes personal data which [F1does] not fall within subsection (1), and
  • (b)
    [F2the first, second or third] condition below is satisfied.
(3A) [F3 The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
  • (a)
    would contravene any of the data protection principles, or
  • (b)
    would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the [F4UK GDPR] (general processing: right to object to processing).]
(4A) [F5 The third condition is that—
  • (a)
    on a request under Article 15(1) of the [F6UK GDPR] (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
  • (b)
    on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on [F7section 45(4) or 78A of that Act].]
(5A) [F8 The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—
  • (a)
    giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—
    • (i)
      would (apart from this Act) contravene any of the data protection principles, or
    • (ii)
      would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded;
  • (b)
    giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the [F9UK GDPR] (general processing: right to object to processing);
  • (c)
    on a request under Article 15(1) of the [F10UK GDPR] (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);
  • (d)
    on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on [F11section 45(4) or 78A of that Act].]
(6) F12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(7) [F13 In this section—
(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the [F17UK GDPR] would be contravened by the disclosure of information, Article 6(1) of the [F17UK GDPR] (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests [F18gateways] in relation to public authorities) [F19disapplied only the gateway in point (ea) (recognised legitimate interests)].]

Amended text

This Section is shown as amended by Data (Use and Access) Act 2025; Data Protection Act 2018; S.I. 2019/419 (see the annotations below), as incorporated in the text in force on 7 October 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Words in s. 40(2)(a) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(2)(a) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
  2. F2 Words in s. 40(2)(b) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(2)(b) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
  3. F3 S. 40(3A)(3B) substituted for s. 40(3) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(3) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
  4. F4 Words in s. 40(3B) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
  5. F5 S. 40(4A) substituted for s. 40(4) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(4) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
  6. F6 Words in s. 40(4A)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
  7. F7 Words in s. 40(4A)(b) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(11)(12), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  8. F8 S. 40(5A)(5B) substituted for s. 40(5) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(5) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
  9. F9 Words in s. 40(5B)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
  10. F10 Words in s. 40(5B)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(2) (with Sch. 3 para. 112)
  11. F11 Words in s. 40(5B)(d) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(11)(12), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)
  12. F12 S. 40(6) omitted (25.5.2018) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(6) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
  13. F13 S. 40(7)(8) substituted for s. 40(7) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 58(7) (with ss. 117, 209, 210, Sch. 20 para. 52); S.I. 2018/625, reg. 2(1)(g)
  14. F14 Words in s. 40(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(3)(a) (with Sch. 3 para. 112)
  15. F15 Words in s. 40(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(3)(b) (with Sch. 3 para. 112)
  16. F16 Words in s. 40(7) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(3)(c) (with Sch. 3 para. 112)
  17. F17 Words in s. 40(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 20(4) (with Sch. 3 para. 112)
  18. F18 Word in s. 40(8) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 70(8)(a)(9)(a), 142(1); S.I. 2026/82, reg. 2(c)
  19. F19 Words in s. 40(8) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 70(8)(b)(9)(a), 142(1); S.I. 2026/82, reg. 2(c)

https://foia.digiphile.law/article/article-40.html

Text as at 7 October 2026.

This is an unofficial convenience version of the Freedom of Information Act 2000. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in October 2026.

Type to search the full text.