Some data carries more risk, so the law asks for more. Special category dataSpecial category dataHealth, genetic and biometric data, racial or ethnic origin, political opinions, beliefs, trade union membership, sex life and sexual orientation. Processing needs an Art 9 condition as well as a lawful basis. needs a lawful basis under Article 6 and a condition under Article 9. Criminal offence data needs a lawful basis and either official authority or a condition in the DPA 2018. Two separate tests, recorded separately.
What counts
Special category data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, and data about sex life or sexual orientation.
Criminal offence data: data about criminal convictions and offences or related security measures, including allegations, investigations and proceedings, and the absence of convictions.
Inferences count. If you deduce someone’s health from their purchases, you are processing health data.
The Article 9 conditions
The ten conditions in Article 9(2) include explicit consent, employment and social security law, vital interests, not-for-profit bodies, data made manifestly public, legal claims, substantial public interest, health and social care, public health, and archiving, research or statistics.
Several of them, including employment, health and social care, public health, research and substantial public interest, only work in the UK when a further condition in DPA 2018 Schedule 1 is also met.
Schedule 1
Schedule 1 Part 1 covers employment, health and social care, public health and research. Part 2 sets out more than twenty substantial public interest conditions, such as statutory purposes, equality monitoring, preventing fraud, safeguarding children and adults at risk, and insurance. Part 3 adds conditions for criminal offence data.
Many Schedule 1 conditions require an appropriate policy document: a short document saying which conditions you rely on, how you comply with the principles, and how long you keep the data. It must be kept, reviewed and made available to the regulator on request.
Choosing a condition
Start with the purpose, as for the lawful basis. Explicit consent is rarely right where there is a power imbalance, such as employment. Employment law, safeguarding or a statutory purpose usually fits better and is more stable, because it cannot be withdrawn.
What else changes
Special category or criminal offence data at scale makes a DPIADPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people. likely to be mandatory and a DPO likely to be required. It also narrows the transparency exceptions, raises the security bar, and affects automated decision rules: since 2026-02-05, significant decisions based solely on automated processing of special category data face tighter limits.
Record it
For each processing activity: the Article 6 basis, the Article 9 condition, the Schedule 1 condition where needed, and whether an appropriate policy document covers it.