Special Category & Health Data Compliance Check

Why this matters

UK GDPR treats certain kinds of personal data as “special category data” under Article 9 — including health information, sickness and occupational health records, racial or ethnic origin, religious beliefs, trade union membership, genetic and biometric data used to identify someone, and data about sex life or sexual orientation. This isn’t a niche issue: any employer holding sickness absence records, running an employee wellbeing or health scheme, using fingerprint or facial recognition for building access, or collecting equality monitoring data is processing special category data. Unlike ordinary personal data, this category can’t be processed on a normal lawful basis alone — a business must identify both an Article 6 lawful basis and a separate Article 9 condition, such as explicit consent, an employment law obligation, or substantial public interest with an appropriate policy document in place.

The ICO treats special category data as high-risk, and mishandling it is one of the most common reasons small businesses fall foul of the law without realising it — often because HR or occupational health records were treated the same as ordinary staff data. Getting this wrong can mean unlawful processing even where a business has a privacy policy and thinks it is GDPR-compliant generally, because the extra Article 9 condition and safeguards were never identified or documented. A proper appropriate policy document, restricted access, and a clear record of the condition relied on are what the ICO expects to see if this data is ever challenged or breached.

What you'll need

• A list of any health, sickness, biometric, or equality/diversity data you collect on staff or customers
• Knowledge of who has access to that data within your business
• Your current privacy policy and any HR or occupational health policies
• Details of the lawful basis and Article 9 condition you currently rely on, if known

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.