Special category personal data in AI: what UK GDPR asks

Special category data under UK GDPR is the short list of personal data the law treats as dangerous to get wrong: health, religion, ethnicity, politics, union membership, sex life, sexual orientation, genetic and biometric data. Most offices do not think they hold much of it. Then someone opens the HR folder, the payroll run or a tribunal bundle and asks an AI to summarise it.

The answer to the question most people actually have is short. The category does not change because a chat window is involved; what changes is how much of it arrives attached to a real person. This guide is about finding it in ordinary British paperwork and taking out the part that makes it someone’s, before it leaves your computer.

If you are choosing which AI tool may be used at all, that is a separate decision, covered in our checklist for choosing AI tools under GDPR. Here the tool is already open and the file is on the desk.

UK GDPR special category data, in the files you already hold

Article 9(1) fits the whole list into one sentence. Four categories are caught by what the data reveals: racial or ethnic origin, political opinions, religious or philosophical beliefs, and membership of a trade union. The other five are named directly: genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation. All nine start from a ban, lifted only where one of the ten exceptions in Article 9(2) is met.

The ICO’s own gloss is that most of these categories are not defined and are fairly self explanatory. Only genetic, biometric and health data get formal definitions. That sounds reassuring until you notice the verb in the article: data revealing a category, not only data that states it.

Revealing is wider than stating

A line on a payslip does not say “this employee is a trade unionist”. It says a sum went to a union. The ICO gives its own example of how little it takes: a statement that Mr X is married to Mr Y reveals the sexual orientation of both. Any document that lets a reader conclude the category, without guessing, is carrying it.

Health follows the same logic and has its own guide on our site, because a clinic letter raises questions of its own. If the file in front of you is clinical, start with our guide for NHS staff on what to strip from a clinic letter first. The rest of this page is about the other categories, and about the office papers where health turns up without anyone calling it clinical.

The nine categories and where they sit in UK paperwork

Category	Where a UK office meets it
Health	Fit notes, sickness absence records, Access to Work letters, occupational health reports
Trade union membership	Union subscription deductions on the payslip, grievance notes naming a rep
Religious or philosophical belief	Requests for leave or shift changes around religious festivals, dietary notes
Racial or ethnic origin	Equality monitoring forms, discrimination claims, asylum statements
Political opinion	Asylum and immigration statements, disciplinary notes about social media posts
Sex life or sexual orientation	Harassment complaints, family court statements, partner details that reveal it
Genetic and biometric data	Fingerprint clocking systems, DNA reports in family or immigration matters

Categories from Article 9(1) UK GDPR and the ICO’s guidance. Examples of paperwork are ours; the sources for each document are listed at the end.

Article 9 adds a second legal question

For ordinary personal data, a business asks one legal question: which of the six lawful bases in Article 6 applies. For special category data it has to answer two. The ICO’s guidance is blunt about it: an Article 6 basis and an Article 9 condition are both required, and neither stands in for the other.

Since 20 August 2025 the article says so itself. The Data (Use and Access) Act 2025 inserted the words “the processing is based on Article 6(1)” into Article 9(2), so the exceptions now open by requiring the ordinary lawful basis first. The same amendment added “or tribunals” to the legal claims condition in Article 9(2)(f), which matters to anyone preparing an employment case.

Ten conditions, and five of them lean on UK law

Article 9(2) lists ten conditions, from explicit consent in (a) to archiving and research in (j). Five of them only work with a basis in domestic law, and in the UK that basis sits in Schedule 1 of the Data Protection Act 2018. Section 10 of the Act is the hinge between the two texts, and Part 2 of Schedule 1 alone holds 23 conditions for the substantial public interest route.

10conditions in Article 9(2)

5need a basis in UK law

23substantial public interest conditions in Schedule 1

For an employer, the usual route is Article 9(2)(b), employment, social security and social protection, which needs condition 1 of Schedule 1. That condition asks for two things: that the processing is necessary for rights or obligations the law imposes in connection with employment, and that the employer has an appropriate policy document in place when it does it.

The document most small firms do not have

The appropriate policy document is a short written account of how the organisation meets the principles for this data and how long it keeps it. The ICO locates the requirement in Schedule 1, at paragraph 5 and paragraphs 38 to 41. Plenty of employers relying on condition 1 have never written one, and a question about AI tends to be the moment it surfaces.

A solicitor bringing or defending a claim usually relies on Article 9(2)(f), legal claims or judicial acts, which needs no Schedule 1 condition at all. That does not settle the AI question. The condition covers what is necessary for the claim, and the ICO’s page on those rules says data minimisation is particularly important for this kind of data: collect and keep only the minimum you can justify.

What the ICO says about AI specifically

The ICO’s guidance on AI and data protection does not create a separate regime. It says that if you intend to use AI to process special category data or criminal offence data, you must comply with Articles 9 and 10 and with the 2018 Act, and that the Article 6 basis and the Article 9 condition do not have to be linked.

A new tool does not bring a new condition with it. The one you already rely on either stretches to cover sending the file to a provider, or it does not.

1. Does the text reveal one of the nine categories, even without naming it?

   YesArticle 9 applies, on top of an Article 6 basis.

   NoNot Article 9, though criminal offence data has rules of its own under Article 10.

2. Does the condition you already rely on stretch to sending it to a provider?

   YesGo on to the next question.

   NoThe AI tool does not bring a condition of its own.

3. Could the task be done from a note that no longer identifies anyone?

   YesTake out who it is, and most of the Article 9 problem stays behind.

   NoThe full text travels, and so does the whole question.

So the practical question moves from the law to the text. If a summary can be produced from a note that no longer identifies anyone, most of the Article 9 problem stops travelling with it. The contract side of that decision is in our checklist for UK firms choosing AI tools.

The paper where it turns up in a UK office

Special category data rarely arrives labelled. It arrives inside documents that exist for another reason: to pay someone, to excuse an absence, to fund a support worker, to bring a claim. Each of the papers below is ordinary in a British office, and each has a category written into it.

Union subscriptions on the payslip

Section 68 of the Trade Union and Labour Relations (Consolidation) Act 1992 regulates subscription deductions: an employer may only take union subscriptions from wages where the worker has authorised it in writing. GOV.UK lists union subscriptions among the deductions an employer can make for the worker’s own use. The result is a monthly line on a payslip that reveals membership, and often which union.

Payroll bureaus and accountancy practices handle those payslips in bulk. When one is attached to an email asking an AI to reconcile net pay, the union line goes with it. For practices doing this weekly, our page on AI for accountants in the UK sets out how the same routine works across a client list.

The fit note, and what its second box says

The fit note is designed to travel from the GP to the employer. GOV.UK’s explanation of the form, issued after April 2022, says its second field records “the health condition(s) affecting your employee’s fitness for work”. That makes every fit note filed in an HR system a piece of health data about a named employee.

The ICO has separate guidance for employers on information about workers’ health, published on 31 August 2023. Its sections cover sickness and injury records, occupational health schemes and health monitoring, which are exactly the records an HR adviser would want an AI to read. In our reading, the diagnosis is rarely the part a summary can do without. The name beside it usually is.

Access to Work letters

Access to Work is the government scheme that helps people get or stay in work if they have a physical or mental health condition or disability. An award letter or a support plan therefore tells anyone who reads it that the person has a condition. It is filed as correspondence rather than as a medical record, and that is precisely why it tends to be missed.

Tribunal and court files

An ET1 claim for disability discrimination describes the disability. A claim of religious discrimination describes the belief. The employment tribunal publishes its decisions online, and GOV.UK’s search covers cases in England, Wales and Scotland from February 2017 onwards, often with the claimant named and the condition discussed at length.

2017

A published judgment is public, but the working file behind it is not. The solicitor’s attendance notes, the medical evidence and the witness statements all sit in the bundle. If you work in a firm, AI for solicitors in England and Wales covers the confidentiality duty that applies whether or not a document is special category data.

Immigration and asylum statements

Section 33 of the Nationality and Borders Act 2022 spells out how the reasons for persecution in the Refugee Convention are read in the UK: race, religion, political opinion, and membership of a particular social group, which may be based on sexual orientation. An asylum statement exists to prove one of those. It is special category data in its purest form, and it is also exactly the long, emotional text people are tempted to have a model tidy up.

The categories nobody flags as sensitive

The papers above at least look serious. The harder cases are the ones that do not, where the special category is a side effect of an ordinary sentence. The ICO acknowledges this directly: the categories are framed broadly and may catch information that is not seen as particularly sensitive, and a broken leg is health data just as a mental health history is.

Inference: when a name or a habit is enough

The ICO accepts that you may be able to infer someone’s religion or ethnicity from their name or from images of them, and says you do not need a condition simply to hold such names on a database. Its test, rewritten in April 2024, is intention. Article 9 is triggered when your processing intends to make an inference about one of the categories, or when you intend to treat someone differently because of it, however confident the inference is.

That test matters when AI is the one reading. Asking a model to “flag anything relevant about this employee’s background” invites exactly the inference the ICO describes. Asking it to summarise a note that already says “fasting during Ramadan” needs no inference, because the text has stated the category for you.

A short list of the quiet ones

Religious belief

Dietary requirements for a staff event, where halal or kosher reveals it.

Sexual orientation

A next of kin entry that names a same sex partner.

Racial or ethnic origin

Equality monitoring answers stored in the same record as the name.

Health

A reasonable adjustment request that names the condition behind it.

Health

A reference that explains a gap in employment by a period of treatment.

None of these would be filed under “sensitive” by the person who wrote them. The vocabulary for talking about what survives once names go is in our comparison of deidentified, pseudonymised and anonymised, which treats the same idea across several regimes.

Criminal offence data sits next door, under different rules

The ICO is explicit that personal data about criminal allegations, proceedings or convictions is not special category data. It sits under Article 10 of the UK GDPR, which allows processing only under official authority or where domestic law authorises it with appropriate safeguards. For a private employer or a firm, that means a condition in Schedule 1 of the 2018 Act.

Section 11(2) of the Act widens the scope: it covers data relating to the alleged commission of offences and to proceedings, including sentencing. The ICO reads “relating to” broadly, so suspicion and allegations count, not only convictions. A council’s licensing and enforcement files hold it routinely, which is why our guide to AI in local government counts them among the records with the most risk.

Where it appears without a charge sheet

A DBS certificate is the obvious example: a basic check shows unspent convictions and conditional cautions, and a standard check shows spent and unspent convictions and cautions. Less obvious are the disciplinary note that records a police caution, the family court statement that alleges an assault, and the tenant reference that mentions an arrest.

For an AI prompt, the practical treatment is the same as for Article 9 data: the allegation can often stay if the person cannot be found from the text. Where the output is going back into proceedings, read our guide to what you certify when AI helped with a court filing before anything is signed.

What the AI provider receives, and in what role

When staff send a note to an AI service, the provider receives whatever the note contains. Under a business agreement it is usually acting as a processor on your instructions; on a personal account it may be neither bound by your contract nor limited to your purpose. Which of those you are in decides a lot, and it depends on the account, not the brand.

The account by account detail for the most common tools is in how ChatGPT handles UK business accounts and where Copilot keeps your prompts. Neither page changes the Article 9 analysis. A processor handling health data is still handling health data, and the firm still needs the condition for sending it there.

The same text, two different disclosures

What is sent	What the provider learns
The note as written	That a named employee at a named employer has depression and is a union member
The note with identifiers replaced	That somebody, somewhere, has depression and is a union member
A summary written from scratch	Whatever you chose to put in it

For the firm the middle row remains personal data, because the key stays in the office. For the provider it is a different disclosure.

The middle row is the one this guide is about. It keeps what the task needs, which is usually the condition, the adjustment or the dispute, and it removes what the task does not need, which is almost always who the person is.

Taking out what makes the text about someone

The ICO’s anonymisation guidance separates a direct identifier, a name for instance, from an indirect one, such as a number you assign to someone, and warns that removing only the names and other direct identifiers leaves the job half done. In practice that means two layers of removal. The first is the identifiers themselves. The second is the context that lets a reader who knows the organisation work out who is meant.

Identifiers in British HR and legal paper

The first layer is easy to list and easy to miss. The person’s name with any title in front of it, then the date of birth, home address and postcode, personal phone and email. Then the numbers: National Insurance number, employee or payroll number, a staff ID, a tribunal case number, a Home Office reference, an NHS number on anything clinical.

Numbers deserve their own pass, because they are the part a quick read skips. A case number or a payroll ID looks administrative, yet it points to one person as surely as a name does, and anyone with access to the right system can follow it.

The context that gives someone away

The second layer is where special category data becomes dangerous. In a firm of forty people, “the only union rep in the Leeds warehouse” or “the finance manager who started in March” identifies someone without a single name. Job title, site, team size, start date and a distinctive event are what the same ICO guidance calls the mosaic or jigsaw effect.

The test we use is the ICO’s motivated intruder, applied to a whole client file in our UK GDPR pseudonymisation guide: could someone reasonably competent and determined identify the person using the note plus what is public? If yes, generalise the role or the place until the answer changes.

Three questions before a note goes out

Question	If yes	If no
Is the special category detail needed for the task?	Keep it, and remove the person	Delete it before anything else
Are there direct identifiers or reference numbers?	Replace or delete each one	Go to the context check
Could a colleague still tell who it is?	Generalise role, site or dates	The note is ready to send

A routine, not a legal test. It reduces what leaves the firm; it does not make the note anonymous.

An HR note through Nonimo 0.2.8

Nonimo runs on the computer itself, on Mac and on Windows. Select a passage and press its key: whatever it recognises as a name, a birth date, a home address or a way of contacting someone becomes a label such as PERSON_1 before anything is copied, so the model only ever sees the labels. Its reply is filled in again with the originals on that same machine, from a map of labels to values kept encrypted there.

Here is an invented HR case note carrying a diagnosis, a union and a faith, before and after the key:

BEFORE
Re: Mr Tobias Whitfield
Employee No: 004417
Date of birth: 30/02/1981
Address: 14 Nowhere Road, Leeds ZZ2 4ZZ
Mobile: 07700 900456
Email: t.whitfield@example.com

Mr Whitfield has been off since 2 September on a fit note for
anxiety and depression. He is a Unite member and his union
subscription comes off his payslip each month. Access to Work
has agreed a support worker. He has asked for his shifts to
move during Ramadan.

Please draft a return to work plan for him.

AFTER (Nonimo 0.2.8)
Re: Mr [PERSON_1]
Employee No: 004417
Date of birth: [BIRTH_DATE_1]
Address: [ADDRESS_1]
Mobile: [PHONE_1]
Email: [EMAIL_1]

Mr [PERSON_2] has been off since 2 September on a fit note for
anxiety and depression. He is a Unite member and his union
subscription comes off his payslip each month. Access to Work
has agreed a support worker. He has asked for his shifts to
move during Ramadan.

Please draft a return to work plan for him.

Invented from top to bottom: 30 February does not exist, 07700 900456 comes from the range Ofcom sets aside for fiction, no postcode area starts with ZZ, and example.com cannot belong to anyone.

Nonimo takes out who the note is about, not what it says about him. The fit note, the Unite membership and Ramadan stay in the text, because the return to work plan needs them, and on your side the note is still special category data. What the app keeps on your disk, and the daily usage count it sends, which never carries a word of your text, are set out on Nonimo’s security page.

What the labelled note still is under Article 9

Replacing names with labels you can reverse is pseudonymisation, and in the ICO’s reading the result remains personal data for anyone holding the additional information. The firm holds it. For the firm, the labelled note remains health data, union data and religious data, and the Article 9 condition still has to cover what it does with it.

What changes is the recipient’s position and the size of any mistake. If the provider suffers a breach, or a prompt is kept longer than promised, the exposed text says that somebody has depression rather than that Tobias Whitfield does. Whether an earlier paste with the name in it was itself a breach has its own answer, account by account, in our breach guide for client data sent to ChatGPT.

Do not tell anyone the note is anonymous

The honest description of a labelled note is “with identifiers replaced”. Calling it anonymised in a privacy notice, a DPIA or a client letter says something the law does not accept, and the ICO’s guidance on anonymisation says removing direct identifiers alone is not enough. Nonimo is built to reduce what leaves the building, not to take the file out of the UK GDPR.

Before the text leaves the computer: a short routine

The steps below take a minute on a one page note and are the same whether the file is payroll, HR, a tribunal bundle or an immigration statement. They assume your organisation has already decided which AI tool may be used; if it has not, our template for an AI acceptable use policy is the place to start.

1. Name the category. Read the text once and say which of the nine it carries, including criminal offence data next door. If you cannot name one, you may not need this routine.
2. Ask whether the task needs it. A request for a formal letter rarely needs the diagnosis. If it does not, delete the detail before anything else.
3. Replace the direct identifiers. Names, dates of birth, addresses, contact details, and every reference number, including the ones that look administrative.
4. Read it as a colleague would. If someone in the same office could still tell who it is, generalise the role, the site or the dates.
5. Keep the key at home. The mapping from labels back to people stays on the firm’s systems, and the reply is restored there, not in the chat.

For solicitors, one more document belongs in the routine: the letter that tells clients you use AI at all. Our engagement letter AI clause for England and Wales is written for that. Taken together, the routine does not remove the Article 9 question. It makes sure the answer has less riding on it.

Sources

• ICO, What is special category data? The nine categories; categories framed broadly (the broken leg example); “revealing” and the Mr X and Mr Y example; inference by intention, updated 9 April 2024; NHS and CHI numbers as health identifiers; criminal offence data is not special category data.
• ICO, What are the rules on special category data? Article 6 basis plus Article 9 condition; ten conditions, five needing a basis in UK law; Schedule 1 paragraphs 5 and 38 to 41 on the appropriate policy document; data minimisation; DPIA triggers; the note that the guidance is under review after the Data (Use and Access) Act.
• ICO, What are the conditions for processing? Condition 1 of Schedule 1 for employment; the 23 substantial public interest conditions.
• UK GDPR, Article 9 Text of Article 9(1) and (2); amendments by the Data (Use and Access) Act 2025 in force 20 August 2025 (“based on Article 6(1)” and “or tribunals”).
• UK GDPR, Article 10 Criminal convictions and offences: official authority or authorisation by domestic law.
• Data Protection Act 2018, section 10 and Schedule 1 The link to Schedule 1; condition 1, employment, with its appropriate policy document.
• Data Protection Act 2018, section 11 Section 11(2): alleged offences and proceedings, including sentencing.
• ICO, What is criminal offence data? “Relating to” read broadly; suspicion and allegations included.
• ICO, How do we ensure lawfulness in AI? AI processing of special category and criminal offence data must comply with Articles 9 and 10 and the 2018 Act; the Article 6 basis and Article 9 condition need not be linked; inferences.
• ICO, Information about workers’ health Employer guidance, published 31 August 2023, last updated 5 March 2024.
• Trade Union and Labour Relations (Consolidation) Act 1992, section 68 Subscription deductions only with the worker’s written authorisation.
• GOV.UK, Deductions from your pay Union subscriptions listed among deductions for the worker’s own use.
• GOV.UK, Fit note: explaining the form Field 2 records the health conditions affecting fitness for work (form issued after April 2022).
• GOV.UK, Access to Work Support for people with a physical or mental health condition or disability.
• GOV.UK, Employment tribunal decisions Decisions for England, Wales and Scotland from February 2017 onwards.
• Nationality and Borders Act 2022, section 33 Reasons for persecution: race, religion, political opinion, particular social group including sexual orientation.
• ICO, How do we ensure anonymisation is effective? Direct and indirect identifiers; removing direct identifiers is insufficient; the mosaic or jigsaw effect; the motivated intruder test.
• ICO, Pseudonymisation Article 4(1)(5) definition; pseudonymised data remains personal data for whoever holds the additional information.
• GOV.UK, DBS checks What basic and standard checks show.