Schedule 3, Part 2, paragraph 6(1)

Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.

← 6 · All articles · 2 →

Source: legislation.gov.uk · retrieved 2026-09-04