What is special category data?
Definition
Special category data is the more sensitive kind of personal data that the UK GDPR protects more strictly, such as health, genetic and biometric data, or information about race, religion, politics, trade union membership, sex life or sexual orientation.
- Category
- Data
- Also called
- special category personal data, sensitive personal data, special categories of personal data
- Last updated
Under the UK GDPR, most personal data is handled under one set of rules, and a smaller group gets extra protection because misuse could do more damage to a person. The ICO, the UK's data protection regulator, calls this group special category data. The thinking is that exposing it can lead to discrimination or other serious harm.
What counts
The ICO lists these categories:
- personal data revealing racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data, when it is used to identify someone
- health data
- data about a person's sex life
- data about a person's sexual orientation
Biometric data is only special category when it is used to uniquely identify you. A photo on its own isn't. Data that merely reveals or concerns one of these topics can count too, and so can details inferred about you. If a company works out your health condition from your shopping history, the inference can be special category data.
Two things the ICO says are not special category data: financial information, and criminal offence data. Both are sensitive, but criminal offence data has its own safeguards in Article 10 of the UK GDPR.
What organisations must do
A company that wants to process special category data needs a normal lawful basis under Article 6 and a separate condition under Article 9. There are 10 Article 9 conditions. Five of them need extra conditions and safeguards set out in Schedule 1 of the Data Protection Act 2018.
Why it matters to you
If you're asked for health details, your religion or your biometric data, you have the right to ask why and on what basis. A mailing list shouldn't be collecting this at all.
How to protect yourself
- 1
Ask why before you hand it over
If a form asks for health, religion, sexual orientation or similar details, ask what it is for and whether it's optional. Leave it blank if it isn't required.
- 2
Check the privacy notice
A UK organisation has to say what it does with your data and on what basis. Look for how it describes health or biometric data, and who it shares it with.
- 3
Use your rights
You can ask an organisation for a copy of the data it holds on you (a subject access request) and, in many cases, ask for it to be corrected or erased. If it doesn't respond properly, you can complain to the ICO.
- 4
Keep sensitive details out of public profiles
Health, political and religious details posted on social media are easy to collect. Review your profile settings and who can see old posts.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is financial data special category data?
No. The ICO says financial data is sensitive but isn't special category data under the UK GDPR. It is still personal data and still protected.
Is criminal record data special category data?
No. Criminal offence data is covered separately by Article 10 of the UK GDPR, which sets its own safeguards.
What is the difference between personal data and special category data?
Personal data is any information about an identifiable person. Special category data is the subset on the ICO's list of sensitive topics, and organisations need an extra condition to process it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.