Special categories of personal data (previously Sensitive Personal Data)

Key Points

  • Under the Data Protection Act 1998 there were provisions relating to 'sensitive personal data'. Under the GDPR and the Data Protection Act 2018, there is no definition of  'sensitive personal data'
  • Under the GDPR there are 'special categories' of personal data which largely reflect the categories which were previously known as 'sensitive personal data'
  • Please see our summary GDPR card here

Sensitive personal data

Under Data Protection Act 1998, section 2, there were provisions relating to sensitive personal data.

The DPA 1998 has been repealed and replaced by the DPA 2018 which incorporates the provisions of the GDPR. Under the GDPR and the DPA 2018 there is no definition of sensitive personal data. The provisions of the legislation refer to personal data.

However, Article 9(1) of the GDPR sets out special categories of information which largely reflect the categories of 'sensitive personal data' under the DPA 1998.

The special categories of personal data are: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data for the purpose of uniquely identifying a natural person; health; sex life and sexual orientation.

Subject to limited exceptions, Article 9(2) of the GDPR  prohibits processing of the special categories of information.