Special categories

The processing of "special categories" of personal data (previously known as sensitive data) is prohibited unless a ground for processing is met.

Special categories includes personal data revealing:

The grounds for processing are set out in Article 9 of the GDPR and in summary are:

Processing of personal data relating to criminal convictions and offences may only be carried out under the control of official authority or when authorised by Union or State law (A new and separate EU Data Protection Directive applies to the processing of such personal data).

Recitals 41-50 of the GDPR provide additional guidance on sensitive personal data.