'Special category' data under the UK GDPR

The UK GDPR classifies some data as 'special category', meaning it's sensitive and needs more protection. Find out what kind of data is defined this way in schools, and the conditions you can use to justify processing it.

Last reviewed on 13 June 2025
School types: AllSchool phases: AllRef: 34954
Contents
  1. What counts as 'special category' data?
  2. What this means for your school
  3. You must meet 1 extra condition for processing special category data
  4. You must get parental consent for processing biometric information
  5. Carry out a data protection impact assessment (DPIA)

What counts as 'special category' data?

'Special category’ data is personal data that's more sensitive because there could be significant risks posed to an individual's rights and freedoms if it's lost or stolen. Therefore, this kind of data needs more protection. 

It includes personal data that reveals:

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership

And data concerning:

  • Genetic information
  • Biometrics (such as fingerprints, retina and iris patterns), where used for identification purposes
  • Health – physical or mental
  • Sex life
  • Sexual orientation

What this means for your school

You are likely to be processing the following types of special category data:

You also process some pupil information that's sensitive, but doesn't