Part 2: General processing Chapter 3: Other general processing Section 24: Manual unstructured data held by FOI public authorities
Although section 21 extends the regime in Chapter 3 to manual unstructured data held by public authorities, the extension is only relevant to processing that is necessary for FOI public authorities to process such personal data in response to information requests by the subject. This replicates the position under the 1998 Act where such records could be disclosed to the subject, where appropriate, but were exempt from most of the rights and duties created by the 1998 Act. Subsection (1) provides that the GDPR provisions listed in subsection (2) do not apply to manual unstructured personal data held by FOI public authorities. This effectively dis-applies the overarching GDPR principles and specified rights of data subjects which are not relevant to the unstructured manual records, such as the right to data portability.
	Subsections (3) and (4) disapply further subject access rights in relation to unstructured manual data where it relates to personnel matters in connection with service in the armed forces, for the Crown or for a Government department.
	Subsection (5) provides that data controllers are not obliged to comply with a data subject access request if the request omits a description of the personal data, or if the controller estimates that complying with the request would exceed the maximum cost. Subsection (6) provides, however, that this does not remove the controller’s obligation to confirm whether or not personal data concerning the data subject is being processed, unless that in itself would exceed the appropriate maximum cost.
	Subsection (7) explains how estimates of cost will be arrived at.
	Subsections (8) and (9) allow the Secretary of State to specify the appropriate maximum cost in regulations, which are subject to the negative resolution procedure.