Schedule 2: Exemptions etc from the GDPR Part 1 – Adaptations and restrictions based on Articles 6(3) and 23(1)
Paragraph 1 sets out the GDPR provisions restricted or adapted by the exemptions in this Part, the "listed GDPR provisions".
	Paragraph 2 restricts the application of the listed GDPR provisions and Article 34(1) and (4) of the GDPR (communication of personal data breach to the data subject) to personal data processed for crime and taxation purposes, to the extent that the processing would be likely to prejudice those purposes. Sub-paragraphs (2) and (3) make provision relating to the further processing of personal data collected for the crime and taxation purposes.
	Paragraph 3 applies where personal data is processed for the crime and taxation purposes by a data controller who is a public body and the restrictions are necessary for the smooth running of a risk assessment system. It restricts a more limited set of GDPR provisions.
	The crime and taxation restrictions in paragraphs 2 and 3 replicate section 29 of the 1998 Act.
	Paragraph 4 restricts the application of the certain GDPR provisions to personal data processed for the purposes of the maintenance of effective immigration control, or the investigation or detection of activities that would undermine the maintenance of effective immigration control, to the extent that the application of those provisions would be likely to prejudice those purposes. Sub-paragraphs (3) and (4) make provision relating to the further processing of personal data for the immigration purposes. For the purposes of paragraph 4 a narrower set of listed GDPR provisions applies as set out in sub-paragraph (2).
	Paragraph 5(1) restricts the application of the listed GDPR provisions to the processing of data protection where the data controller is obliged, under an enactment, to disclose personal data to the public, to the extent the application of those provisions would prevent compliance with that obligation. This is based on the exemption under section 34 of the 1998 Act.
	Paragraph 5(2) and (3) restrict the listed GDPR provisions where the disclosure of personal information is required by law or necessary for the purposes of or in connection with legal proceedings or necessary for obtaining legal advice or establishing exercising or defending legal rights. They replicate the exemptions under section 35 of the 1998 Act.