Privilege is a genuine exemption, not a convenient label. Applied as a blanket, it invites exactly the scrutiny it was meant to avoid.
Material covered by legal professional privilege is exempt from the right of access under Schedule 2, Part 4, paragraph 19 of the Data Protection Act 2018 — but you must identify and record the privilege claim on the material to which it genuinely applies, not withhold whole files by default. This concerns any UK controller, and law firms in particular, responding to a request under Article 15 of the UK GDPR.
What does the privilege exemption cover?
Paragraph 19 has two limbs. Limb (a) exempts information over which a claim to legal professional privilege could be maintained in legal proceedings. Limb (b), which was new in 2018, extends the exemption to information over which a professional legal adviser owes a duty of confidentiality to a client — potentially wider than privilege itself. The ICO’s guidance on SAR exemptions explains how the exemption applies in practice.
Litigation privilege versus legal advice privilege
Privilege has two branches. Legal advice privilege protects confidential communications between a client and a legal adviser for the purpose of seeking or giving legal advice. Litigation privilege protects confidential communications between a client, adviser, or third party where litigation is contemplated or under way and the communication is for the dominant purpose of that litigation. Both must be confidential to attract privilege, and litigation privilege depends on the dominant-purpose test being met.
Why you can’t blanket-withhold
Privilege attaches to communications, not to files, folders, or the mere involvement of a lawyer. A document does not become privileged simply because a solicitor is copied in, and business advice dressed up as legal advice will not qualify. The Dawson-Damer litigation showed that courts will look behind an over-broad privilege claim. The exemption applies to the extent the material is genuinely privileged — which means a document-level assessment, not a wholesale exclusion.
How to record a privilege claim
For each item withheld, record the branch of privilege relied on, why it applies, and who assessed it. A privilege log created during the review is far more defensible than a blanket assertion offered after a complaint, and it lets you demonstrate that the exemption was applied item by item. This is the same principle set out in audit trails are not evidence unless they capture reasoning — the claim has to be evidenced, not reconstructed. Applied carelessly, a privilege claim becomes one more reason a response fails under scrutiny, as in why most DSAR redaction processes fail under scrutiny.
Frequently asked questions
No. Only confidential communications for the purpose of legal advice (legal advice privilege), or for the dominant purpose of litigation that is contemplated or under way (litigation privilege), are covered. Commercial or administrative communications that happen to involve a lawyer are not privileged simply by that involvement.
No. Copying a lawyer into a communication does not make it privileged. The exemption depends on the nature and purpose of the communication, assessed document by document, not on who appears in the recipient line.
You should generally confirm that some information has been withheld under the legal professional privilege exemption, without describing the privileged content. Being transparent about the exemption relied on, and keeping a privilege log internally, helps demonstrate the claim was properly considered if it is later challenged.