6. Refusal to confirm or deny existence, use or disclosure of personal data

Subject to section 21(4) of the Act, an organisation, in a response to a request made to it under section 21(1) of the Act, may refuse to confirm or may deny any of the following:

the existence of personal data mentioned in paragraph 1(h) of the Fifth Schedule to the Act as in force before, on or after 1 February 2021;

the use or disclosure of personal data without consent under the following provisions for any investigation or proceedings, if the investigation or proceedings and related appeals have not been completed:

paragraph 3 of Part 3 of the First Schedule to the Act as in force on or after 1 February 2021;

paragraph 1(e) of the Third Schedule to the Act or paragraph 1(f) of the Fourth Schedule to the Act (as the case may be) as in force before 1 February 2021.