Special category data is broadly similar to the concept of sensitive personal data under the 1998 Act. The requirement to identify a specific condition for processing this type of data is also very similar.
One change is that the GDPR includes genetic data and some biometric data in the definition. Another is that it does not include personal data relating to criminal offences and convictions, as there are separate and specific safeguards for this type of data in Article 10.
The conditions for processing special category data under the GDPR in the UK are broadly similar to the Schedule 3 conditions under the 1998 Act for the processing of sensitive personal data.
Special category data is personal data which the GDPR says is more sensitive, and so needs more protection.
In order to lawfully process special category data, you must identify both a lawful basis for processing and a separate condition for processing special category data. These do not have to be linked.
There are ten conditions for processing special category data in the GDPR itself, but the Data Protection Act 2018 introduces additional conditions and safeguards.
You must determine your condition for processing special category data before you begin this processing under the GDPR, and you should document it.
