Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
UK GDPR treats certain kinds of personal data as “special category data” under Article 9 — including health information, sickness and occupational health records, racial or ethnic origin, religious beliefs, trade union membership, genetic and biometric data used to identify someone, and data about sex life or sexual orientation. This isn’t a niche issue: any employer holding sickness absence records, running an employee wellbeing or health scheme, using fingerprint or facial recognition for building access, or collecting equality monitoring data is processing special category data. Unlike ordinary personal data, this category can’t be processed on a normal lawful basis alone — a business must identify both an Article 6 lawful basis and a separate Article 9 condition, such as explicit consent, an employment law obligation, or substantial public interest with an appropriate policy document in place.
The ICO treats special category data as high-risk, and mishandling it is one of the most common reasons small businesses fall foul of the law without realising it — often because HR or occupational health records were treated the same as ordinary staff data. Getting this wrong can mean unlawful processing even where a business has a privacy policy and thinks it is GDPR-compliant generally, because the extra Article 9 condition and safeguards were never identified or documented. A proper appropriate policy document, restricted access, and a clear record of the condition relied on are what the ICO expects to see if this data is ever challenged or breached.
