Adult Support and Protection (Scotland) Act 2007: guidance for General Practice

Special Category Data

What is special category data? This is personal data that needs more protection because it is sensitive and may affect an individual's rights and freedoms. This means data which:

• reveals racial or ethnic origin;
• reveals political opinions;
• reveals religious or philosophical beliefs;
• reveals trade union membership;
• is genetic data;
• is biometric data;
• is concerning an individual's health;
• is concerning an individual's sexual orientation or activity.

If you process special category data you must keep records, including documenting the categories of data. This does not include personal data about criminal allegations, proceedings or convictions, as separate rules apply (see below).

In order to process special category data, you must identify both a lawful basis to process under Article 6 of the UK GDPR and a separate condition for processing under Article 9. These do not have to be linked.

Where Criminal Offence data, including data relating to alleged offences and to victims, is being processed, official authority or an additional condition under Article 10 of the UK GDPR is required. The Data Protection Act 2018 contains specific legal gateways for processing special category and criminal offence data for safeguarding purposes, namely those at Data Protection Act 2018 Schedule 1 Part 2, Paragraphs 18 (Safeguarding of children and of individuals at risk) and Paragraph 19 (Safeguarding of economic well-being of certain individuals).