What is special category data?

Special category data is the set of personal data types that Article 9 of the UK GDPR and EU GDPR treats as especially sensitive, such as health, genetic and biometric data. Processing it needs one of the specific conditions set out in Article 9(2).

The Article 9(1) list

Article 9(1) names eight kinds of special category data:

Processing any of these needs one of the conditions in Article 9(2). In the UK, the conditions in Schedule 1 to the Data Protection Act 2018 also apply.

Criminal offence data is separate

Data about criminal convictions and offences, or related security measures, is not special category data. It has its own rule in Article 10: it may only be processed under official authority or where authorised by law. In the UK, that authorisation comes from sections 10 and 11 of the DPA 2018 and the Schedule 1 conditions. In practice it needs similar care, so the two are often handled together.

Why it matters

Special category data carries a higher risk of harm to people if it is lost, misused or disclosed. That has practical consequences.

• You need an Article 9(2) condition. In the UK, also look at DPA 2018 Schedule 1.
• It can make a DPIA mandatory. Article 35(3) requires a data protection impact assessment for large-scale processing of special category or criminal offence data. See what is a DPIA.
• It removes the small-organisation record-keeping exemption. The Article 30 exemption for organisations under 250 employees does not apply where processing includes special category or criminal offence data. See what is a RoPA.

Special category data often turns up where nobody planned to keep it: a health condition mentioned in an email chain saved to a case file, or a trade union reference in a disciplinary letter.

How DOCNUS flags it

The privacy assessment on Professional and Enterprise plans looks for special category data in its health, belief, origin and sexuality groups. These cover diagnosis, treatment, disability, genetic and biometric data, religion, philosophical belief, political opinion, trade union membership, racial or ethnic origin, sexual orientation and sex life. The origin group also detects nationality and citizenship or immigration status, which are not Article 9 categories. The justice group covers criminal convictions, offences and proceedings.

Under the UK and EU GDPR packs, special category data leads to a high risk verdict citing Article 9(1) and 9(2), and for the UK also DPA 2018 Schedule 1. Criminal offence data leads to "attention required" citing Article 10. The verdict is set by code, not by the AI model, as explained in AI finds facts, code decides law.

The result is an automated risk assessment, not legal advice. It tells you where sensitive data appears and on which page, but it does not decide whether you have a valid Article 9(2) condition. Review the findings yourself.