Special category data

Which information gets extra protection?

Special category data covers nine types of sensitive information: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data used for unique identification; health; sex life; and sexual orientation.

An inference can qualify when you deliberately draw or use it to treat someone differently. Employment examples include sickness and disability information, occupational-health reports, equality monitoring and trade union membership. Criminal-offence data is sensitive too, but it sits under a separate legal regime rather than this list.

Use the two-part legal test

Before processing special category data, identify an Article 6 lawful basis and a separate Article 9 condition. Neither one replaces the other. The ICO's special-category guidance also requires the use to remain necessary, proportionate, transparent, limited to what is needed and properly secured.

Do not assume explicit consent fixes every employment use. A worker may not have a realistic choice where saying no could affect their job. Start with the precise purpose, then test the conditions that genuinely fit it.

Add the DPA 2018 safeguard when required

Some Article 9 conditions rely on additional requirements in the Data Protection Act 2018. For employment, social security and social protection, the processing must be necessary for legal rights or obligations, meet the matching Schedule 1 condition and use an appropriate policy document where required.

Record the data category, purpose, Article 6 basis, Article 9 condition, any Schedule 1 condition, why the use is necessary, privacy information, access limits, retention and whether a data-protection impact assessment is needed. That record should explain the real decision rather than repeat a generic policy phrase.