Special category data

Special category data is the personal data the law treats as most sensitive: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health, and sex life or sexual orientation. You may process it only with a lawful basis and an extra condition.

Clauses

UK GDPR Article 9(1) · EU GDPR Article 9(1) · UK GDPR Article 9(2) · Data Protection Act 2018 schedule 1 · UK GDPR Article 10

Where the term appears

UK GDPR Article 9(1) and EU GDPR Article 9(1) list the categories and prohibit processing them unless one of the conditions in Article 9(2) applies, such as explicit consent, employment law duties or health care. In the UK, Data Protection Act 2018 schedule 1 supplies most of the detail, and many of its conditions also need an appropriate policy document. Since 20 August 2025 the UK Secretary of State can add new kinds of processing to the prohibition by regulations, and set the conditions that apply to those additions; the EU text has no such power. The lawful basis page covers both layers.

Two keys, not one

An auditor checks that each use of special category data names both an Article 6 basis and an Article 9(2) condition. Explicit consent is a stricter thing than ordinary consent, and it rarely suits an employer. Criminal convictions and offences are not special category data: they have their own rule in UK GDPR Article 10, so a background check needs its own condition.

How Sted uses it

Related terms

• Personal data: the broader term; special category data is a subset.
• Lawful basis: the first key, which every use of personal data needs.
• Data protection impact assessment (DPIA): large-scale use of special category data is one of the commonest triggers.
• Data protection officer (DPO): needed when this data is a core activity at large scale.