Schedule 2: Exemptions etc from the GDPR Part 4 – Restrictions based on Article 23(1): restrictions of rules in Articles 13 to 15
Paragraph 18 sets out the listed GDPR provisions restricted by the exemptions in this Part.
	Paragraph 19 restricts the application of the listed GDPR provisions to personal data that consists of information over which a claim to legal professional privilege (or in Scotland, confidentiality in communications) could be maintained in legal proceedings, or information covered by a duty of confidentiality owed by a professional legal adviser to a client of the adviser. It expands on the exemption in paragraph 10 of Schedule 7 to the 1998 Act.
	Paragraph 20 restricts the obligation to comply with the listed GDPR provisions to the extent that compliance would result in self-incrimination. It also provides that information disclosed by a person in compliance with Article 15 is not admissible against the person in proceedings for an offence under Parts 5 or 6 of the Act. This replicates the exemption in paragraph 11 of Schedule 7 to the 1998 Act.
	Paragraph 21 restricts the application of the listed GDPR provisions to personal data processed for the purposes of, or in connection with, a corporate finance to the extent that one of the conditions set out in that paragraph is met. This restriction is based on the exemption for this purpose under paragraph 6 of Schedule 7 to the 1998 Act and the Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184).
	Paragraph 22 restricts the application of the listed GDPR provisions to personal data processed for management forecasting or management planning purposes, to the extent the application of those provisions would prejudice the conduct of the business or activity concerned. This replicates the exemption for this purpose under paragraph 5 of Schedule 7 to the 1998 Act.
	Paragraph 23 restricts the application of the listed GDPR provisions to personal data that consists of the data controller’s record of his or her intentions in relation to any negotiations with the data subject, to the extent that the application of those provisions would be likely to prejudice the negotiation. Paragraph 21 replicates the exemption for this purpose under paragraph 7 of Schedule 7 to the 1998 Act.
	Paragraph 24 restricts the application of the listed GDPR provisions to personal data consisting of a reference given (or to be given) in confidence, for example for education or employment purposes. This replicates and extends the exemption in paragraph 1 of Schedule 7 to the 1998 Act.
	Paragraph 25 restricts the listed GDPR provisions where personal data consists of information recorded by candidates during an exam. It also modifies the time limits for complying with disclosure obligations under Article 15, where the personal data to be disclosed consists of examination marks or other information processed for the purposes of determining the results of an exam. This ensures candidates cannot obtain their exam marks they are first published and replicates the exemption for those purposes under paragraphs 8 and 9 of Schedule 7 to the 1998 Act.