Glossary · Glossary · Sensitive data
Special category data: health, union membership, criminal offence data and more
Anonimatum Team
In short
Personal data that Article 9 of the UK GDPR and EU GDPR bans processing except in listed cases: health, ethnicity, politics, religion, union membership, genetics, biometrics, sex life or orientation. Criminal offence data falls under Article 10.
Among all personal data, the GDPR reserves stronger protection for information that could lead to discrimination or serious harm if exposed. This is special category data, often called sensitive personal data.
Processing it is prohibited by default and lawful only under the conditions in Article 9(2). Criminal offence data is not on that list, but Article 10 subjects it to an equally strict regime. For anyone sharing or publishing documents, the consequence is simple: when this data appears, the margin for error shrinks.
What Article 9 covers
- Racial or ethnic origin.
- Political opinions, religious or philosophical beliefs.
- Trade union membership.
- Genetic data, and biometric data used to uniquely identify a person.
- Data concerning health.
- Data concerning a person’s sex life or sexual orientation.
Article 9(2) lists the exceptions, including explicit consent, employment and social security obligations, vital interests, data manifestly made public by the individual, legal claims, substantial public interest, health and social care, public health, and archiving, research and statistics. Outside those conditions, processing is unlawful.
Criminal offence data: Article 10
Personal data relating to criminal convictions and offences may only be processed under the control of official authority or where authorised by law with appropriate safeguards. In the UK, the Data Protection Act 2018 provides that authorisation: section 10(5) points to the conditions in Parts 1 to 3 of Schedule 1.
UK specifics: DPA 2018 Schedule 1
Several Article 9(2) exceptions, such as employment, health and social care, and substantial public interest, only work in the UK if you also meet a condition in Schedule 1 of the DPA 2018 (section 10). Many of those conditions require an appropriate policy document explaining how you comply with the data protection principles and how long you keep the data. The ICO’s guidance on special category data walks through each condition.
Large-scale processing of special category or criminal offence data is also one of the cases in which Article 35(3) requires a Data Protection Impact Assessment. In the US there is no single federal equivalent; health information held by covered entities is protected health information under HIPAA, which has its own de-identification standards.
Why documents with sensitive data need stronger anonymisation
If a document with ordinary data is re-identified, a name or address is exposed. If it contains special category data, a diagnosis, a political affiliation or a conviction is exposed. The acceptable level of risk falls and contextual re-identification matters more. Sensitive data is also often revealed indirectly:
| Category | Document example | Indirect disclosure |
|---|---|---|
| Health | An employee’s fit note | The name of a drug or hospital unit reveals the condition |
| Union membership | Minutes of a pay negotiation | A signature as union representative |
| Religion or belief | A leave request for a religious festival | The specific festival suggests the faith |
| Sexual orientation | A marriage leave form | The spouse’s name |
| Biometrics | A time-and-attendance log | An attached fingerprint or face template |
| Criminal offence data (Art. 10) | A recruitment file | A DBS certificate or mention of a past conviction |
In practice that means checking not only names and ID numbers but also the terms that reveal the category: diagnoses, medicines, clinics, union roles, references to criminal proceedings. For clinical files, see how to anonymise medical records while keeping the report useful.
Handling it with Anonimatum
Anonimatum uses AI to detect names, dates, addresses and amounts, and patterns for identifiers such as phone numbers, emails or IBANs. For sensitive terms specific to your organisation you can define custom patterns with regular expressions or word lists, for example a list of diagnoses or clinic names. Everything is reviewed before applying, redaction is irreversible, and processing runs on Anonimatum’s own AI on EU servers without sending text to third-party models.
Frequently asked questions
Is criminal offence data special category data?
Not formally: Article 9 does not list it. It has its own regime under Article 10 and, in the UK, under section 10(5) and Schedule 1 of the DPA 2018, with comparable restrictions.
Is a fit note health data?
Yes. Any information about a person’s physical or mental health, including information revealing sickness absence, is data concerning health.
Is consent enough to process sensitive data?
Only explicit consent qualifies under Article 9(2)(a), and in employment contexts it is rarely freely given. Other conditions, often with a Schedule 1 condition in the UK, are usually more appropriate.
If I anonymise a document properly, does Article 9 still apply?
If the output is genuinely anonymous it is no longer personal data and the GDPR does not apply to it. The anonymisation process itself, however, is processing of special category data and needs a lawful basis.
Handling documents with health or criminal data?
See the plans and start redacting sensitive data in your own document types, with custom patterns and human review before anything is shared.