What Is Special Category Data?
Understanding what special category data means under the UK GDPR, when you can process it, and how to protect it properly.
By Dan Connolly, DLC Tech Solutions · Last updated 29 September 2026
Book a ConsultationSpecial category data: definition
Special category data is personal data that the UK GDPR says needs extra protection because of its sensitivity. It covers data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about a person's sex life or sexual orientation.
Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data (for identification)
Health data
Sex life or sexual orientation
It also includes information you can infer about these things with reasonable certainty, for example deducing a health condition from purchase history. This is set out in Article 9 of the UK GDPR.
When can you process special category data?
You cannot process special category data unless you can identify both a lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9. The ten conditions for processing special category data are:
- ●Explicit consent from the individual (Article 9(2)(a))
- ●Necessary for employment, social security or social protection law obligations (Article 9(2)(b))
- ●Necessary to protect vital interests where the individual cannot give consent (Article 9(2)(c))
- ●Processing by a not-for-profit body with appropriate safeguards (Article 9(2)(d))
- ●Personal data manifestly made public by the individual (Article 9(2)(e))
- ●Necessary for legal claims or judicial proceedings (Article 9(2)(f))
- ●Necessary for reasons of substantial public interest (Article 9(2)(g))
- ●Necessary for health or social care purposes (Article 9(2)(h))
- ●Necessary for public health purposes (Article 9(2)(i))
- ●Necessary for archiving, research or statistical purposes (Article 9(2)(j))
The DPA 2018 Schedule 1 conditions
Five of the Article 9 conditions can't be used on their own in the UK. Employment and social security (b), health and social care (h), public health (i) and research (j) also require a matching condition from Part 1 of Schedule 1 to the Data Protection Act 2018. Substantial public interest (g) requires one of the 23 specific conditions in Part 2 of Schedule 1, such as equality of opportunity, preventing or detecting unlawful acts, or complying with regulatory requirements.
Do you need an appropriate policy document?
Many Schedule 1 conditions, including the employment condition and most substantial public interest conditions, require an appropriate policy document (APD). This is a short document explaining:
- ●which Schedule 1 condition you rely on
- ●how you comply with the UK GDPR principles for that processing
- ●your retention and erasure policies for that data
You must keep the APD for six months after the processing ends, review it regularly, and provide it to the ICO on request. Many small organisations processing HR or diversity data don't realise they need one.
Not sure if you need an APD? Our GDPR audit checks this.
Free appropriate policy document template
A ready-to-edit UK GDPR APD template covering employment and equality monitoring conditions, with guidance notes. Used by small businesses handling HR and health data.
Special category data vs criminal offence data vs personal data
| Type | Examples | What you need |
|---|---|---|
| Personal data | Name, email, date of birth, job title | An Article 6 lawful basis |
| Special category data | Health records, ethnicity, biometrics, trade union membership | An Article 6 lawful basis + an Article 9 condition (+ Schedule 1 condition where required) |
| Criminal offence data | Criminal convictions, DBS check results, allegations of offences | An Article 6 lawful basis + official authority or a Schedule 1 condition (Article 10) |
Personal data
Examples: Name, email, date of birth, job title
What you need: An Article 6 lawful basis
Special category data
Examples: Health records, ethnicity, biometrics, trade union membership
What you need: An Article 6 lawful basis + an Article 9 condition (+ Schedule 1 condition where required)
Criminal offence data
Examples: Criminal convictions, DBS check results, allegations of offences
What you need: An Article 6 lawful basis + official authority or a Schedule 1 condition (Article 10)
Criminal offence data is not special category data, but it has similar extra safeguards.
Examples of special category data at work
Sick notes and absence records
Yes. Information about an employee's health is health data, even a brief reason for absence.
Diversity and equality monitoring forms
Yes. Ethnicity, religion, disability and sexual orientation are all special categories. Organisations often rely on the equality of opportunity condition, which requires an appropriate policy document.
Fingerprint or face recognition clock-in systems
Yes. Biometric data used to identify people is special category data. You'll usually need a DPIA and should offer a non-biometric alternative.
Staff photos on your website
Usually no. A photo only becomes biometric data when processed with specific technology to uniquely identify someone.
Occupational health referrals
Yes. Health data, typically processed under the employment or health and social care conditions.
Trade union subscription deductions via payroll
Yes. This reveals trade union membership.
Failing to apply the correct safeguards to special category data can result in significant GDPR fines. The ICO takes a particularly serious view of breaches involving sensitive data, especially health records and children's data.
Do you process special category data? 60-second check
Question 1 of 5
Do you keep sickness absence or occupational health records?
Do you run diversity or equality monitoring?
Do you use fingerprint or facial recognition for access or clock-in?
Do you process client or patient health information?
Do you deduct trade union subscriptions through payroll?
Protecting special category data
- ●Conduct a Data Protection Impact Assessment (DPIA), mandatory for large-scale processing of special category data (Article 35)
- ●Implement strong access controls, restricting access to authorised personnel only
- ●Encrypt special category data at rest and in transit
- ●Maintain detailed records of processing activities (ROPA)
- ●Record in your ROPA which Article 9 and Schedule 1 conditions you rely on
- ●Apply data minimisation, only collecting what is genuinely necessary
- ●Train staff on the heightened requirements for sensitive data
Special category data FAQs
Is special category data the same as sensitive personal data?
Largely, yes. "Sensitive personal data" was the term used under the Data Protection Act 1998. The main difference is that criminal offence data is now treated separately rather than as special category data.
Do I always need explicit consent to process special category data?
No. Explicit consent is only one of ten conditions. In employment, consent is often unsuitable because of the power imbalance, so organisations usually rely on the employment condition instead.
Is criminal record data special category data?
No. It is criminal offence data, covered by Article 10 of the UK GDPR, with its own rules.
Is a photograph special category data?
Not by default. It becomes biometric special category data only when processed using specific technical means to uniquely identify a person, such as facial recognition.
Is date of birth or gender special category data?
No. Age and sex are ordinary personal data. However, data revealing someone's sexual orientation or health is special category data.
Do I need a DPIA to process special category data?
A DPIA is mandatory for large-scale processing of special category data, and is strongly recommended in most other cases.
What happens if I get it wrong?
The ICO can issue fines, reprimands and enforcement notices, and treats breaches involving health and other sensitive data particularly seriously.
"We knew we were handling sensitive data but hadn't got round to formalising how we manage it. DLC made the process straightforward, they explained where the risks were, didn't overcomplicate it, and gave us everything we needed to demonstrate we take compliance seriously."
How we can help
Appropriate policy document
We draft your APD based on your actual processing, ready for ICO scrutiny.
Fixed scope, quoted per engagement
Discuss thisDPIA for sensitive data
A completed DPIA for biometric systems, health data or large-scale HR processing.
Fixed scope, quoted per engagement
Discuss thisSpecial category data review
We map where you hold sensitive data, check your conditions and safeguards, and give you a prioritised fix list.
Fixed scope, quoted per engagement
Discuss thisPrefer a broader review? A GDPR audit checks your safeguards end to end, our GDPR compliance services cover control implementation, and we have specific support for healthcare organisations.
Ready to Get Started?
Processing health, HR or biometric data? Talk to us about making sure your conditions, policy documents and safeguards are in order.
Get in Touch