What is special category data? Health and SEND data under UK GDPR

Learner support runs on special category data. That makes this one of the most important terms for inclusion leads and data protection officers.

What counts as special category data?

Article 9 of the UK GDPR lists the categories: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data used to identify a person; data concerning health; and data concerning a person’s sex life or sexual orientation. Processing it is prohibited unless one of the listed conditions applies.

The ICO explains that health data covers a person’s past, present or future physical or mental health, including information about a disability and the provision of care. Inference matters: if information reveals or is used to infer a special category, it can fall into scope.

How does special category data apply in FE and apprenticeships?

You need two things to process special category data lawfully: a lawful basis under Article 6 and a separate condition under Article 9. Several Article 9 conditions rely on Schedule 1 of the Data Protection Act 2018, which may require an appropriate policy document. Conditions that education providers might consider, depending on the facts, include explicit consent, employment and social protection, and substantial public interest conditions such as equality of opportunity or treatment and support for individuals with a particular disability or medical condition. The right choice is for the provider, with its data protection officer, to decide and record.

Practical steps include collecting only what you need, limiting who can see it, being clear with learners about why you hold it, and being careful when sharing with employers. An employer usually needs to know what adjustment to make, not the underlying diagnosis. See our guide to special category data in education and the trust page on data protection.

It is likely that a DPIA will be needed before adopting a system that holds this data at scale.

What is a common misconception about special category data?

The most common is that you need consent for everything. Consent has to be freely given, specific, informed and unambiguous, and it is often a poor fit where a learner depends on the provider. Another is that anonymising a label like “Learner A” removes the risk; if the person can still be identified, it remains personal data. A third is that only formal diagnoses count. Information about support needs, absence due to illness and counselling notes can all be health data.

Where can you find the official source?

Read Article 9 of the UK GDPR, Schedule 1 of the Data Protection Act 2018 and the ICO’s guidance on special category data. The ICO guidance is being reviewed following the Data (Use and Access) Act 2025, so check for updates. This is general information, not legal advice.