Special category data in schools

The rule: Article 9 of the UK GDPR and Schedule 1 to the DPA 2018

Article 9 of the UK GDPR prohibits processing special category data unless the school has a lawful basis under Article 6 and one of the conditions in Article 9(2) applies. Article 9(1) of the UK GDPR reads: “Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.” Article 9(2) lifts the prohibition: “Paragraph 1 shall not apply if the processing is based on Article 6(1) and one of the following applies”.

Two definitions in Article 4 of the UK GDPR do most of the work in a school. Health data, under Article 4(15), is “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status”, so an allergy, an inhaler, a mental health referral and a fit note all count. Biometric data is defined in Article 4(14), and Article 9(1) makes it special category only when it is processed “for the purpose of uniquely identifying a natural person”, which is exactly what a fingerprint reader at a canteen till or library desk does.

The Department for Education's guidance What data protection means for schools puts it simply: “Special category data is personal data that’s considered more sensitive and given greater protection in law.” Its companion page, Data processing a school is permitted to do, sets the test: “You need to ensure that at least one lawful basis and one condition – which does not have to be linked to the lawful basis – applies.”

Most of the Article 9(2) conditions a school uses are not complete on their own. Section 10 of the Data Protection Act 2018 says that processing under Article 9(2)(b) (employment), (h) (health or social care), (i) (public health) or (j) (archiving and research) also needs a condition in Part 1 of Schedule 1, and section 10(3) says processing under Article 9(2)(g), substantial public interest, meets the requirement for a basis in UK law “only if it meets a condition in Part 2 of Schedule 1.” Schedule 1 to the Data Protection Act 2018 is therefore the document a school's choices are recorded against.

The regulator is the Information Commission, still known as the ICO. The office of Information Commissioner, from which the Information Commissioner's Office took its name, was abolished on 30 September 2026 under section 118 of the Data (Use and Access) Act 2025, and Schedule 1 now says “the Commission”. The same Act inserted Article 11A of the UK GDPR, which lets the Secretary of State add new special categories by regulations (and later lift the prohibition from any so added); it is a power only, and no regulations had been made under it when this guide was checked on 29 October 2026.

Special category data examples in schools, and what is not on the list

Schools hold special category data about pupils, staff, parents and governors every day, and the school (in an academy, the trust) is the data controller for all of it. Typical examples of special category pupil data and staff data in a school in England:

• Health. Medical conditions and individual healthcare plans, allergies and dietary needs for medical reasons, medication records, first aid and accident notes that describe an injury, mental health and counselling referrals, staff sickness absence, fit notes and occupational health reports. The medication records guide covers the records themselves.
• Racial or ethnic origin, and religion. Ethnicity and religion recorded at admission and in the school census, faith information collected by a school with a religious character, and staff equality monitoring.
• Biometrics. Fingerprints or facial recognition used for cashless catering, library loans or registration.
• Trade union membership. Union subscriptions deducted through payroll, and records of facility time.
• Sex life or sexual orientation. A disclosure by a pupil or a member of staff, recorded in a pastoral note or an HR file.
• Genetic data and political opinions. Rare in schools, but a genetic diagnosis in a medical report counts, and so would a record of a staff member's political activity.

Inferences count. Information that is not itself on the list can still be special category data – a meal choice used to infer a pupil's religion, or a timetable change made because of a medical condition. The ICO's page What is special category data? says it depends on whether the processing “intends to make an inference linked to one of the special categories of data” or the school intends to “treat someone differently on the basis of inferred information linked to one of the special categories of data”; where either applies, “the inferred data is special category data regardless of how confident you are that the inference is correct.”

SEN and safeguarding information are not special category data in law. Article 9 does not mention special educational needs, safeguarding, pupil premium, children in need or looked-after children. The DfE asks schools to protect them in the same way. Its guidance says: “In a school, it would be best practice to also treat as special category data any personal data about: a safeguarding matter pupils in receipt of pupil premium pupils with special educational needs and disability (SEND) children in need (CIN) children looked after by a local authority (CLA)”. In practice the difference narrows, because an EHC plan, a SEN support record or a safeguarding file usually contains health information or other special category details, and those details are special category in law. The honest position for a school is: apply the same protections to the whole of these records, as the DfE advises, and know which parts need an Article 9 condition.

Criminal offence data is separate. The ICO is clear that personal data “isn't special category data when it's about criminal allegations, proceedings or convictions”, although “there are similar rules and safeguards for processing it.” In a school the commonest example is the DBS check. The DfE says: “Schools process criminal offence data in storing the outcome of a Disclosure and Barring Service (DBS) check on their employees, non-employed staff and volunteers. As this data relates to criminal convictions, collecting and retaining it means the school is processing criminal offence data. This applies even though the check has not revealed any conviction.” That processing is governed by Article 10 of the UK GDPR and section 10(5) of the 2018 Act, which also points to Schedule 1.

Sensitive is not the same as special category. Financial information, home addresses, free school meals eligibility in itself and attendance are sensitive, but the ICO says other sensitive information such as “a person's financial information … doesn't count as special category data for the purposes of the UK GDPR.” They still need a lawful basis, security proportionate to the harm a breach would cause, and the DfE's best-practice protection where they sit inside a pupil premium or safeguarding record.

Special category data conditions schools rely on

A school seldom needs consent for special category data. For its core work it usually relies on four routes, each with its Schedule 1 condition:

1. Employment: Article 9(2)(b) with Schedule 1 paragraph 1. Staff sickness, occupational health, reasonable adjustments, and trade union deductions are processed to meet obligations “imposed or conferred by law … in connection with employment”. The DfE's first worked example says “a school can process special category data for people with whom it has a contract of employment.” Paragraph 1 itself requires an appropriate policy document.
2. Statutory functions: Article 9(2)(g) with Schedule 1 paragraph 6. Paragraph 6 covers processing that “is necessary for a purpose listed in sub-paragraph (2), and … is necessary for reasons of substantial public interest”, the first purpose being “the exercise of a function conferred on a person by an enactment or rule of law”. Supporting pupils with medical conditions, a duty on maintained schools and academies under section 100 of the Children and Families Act 2014, is the clearest example.
3. Safeguarding: Article 9(2)(g) with Schedule 1 paragraph 18. Paragraph 18 applies where processing is necessary to protect someone under 18, or an adult at risk, “from neglect or physical, mental or emotional harm”, or to protect their well-being; it is carried out without the consent of the data subject – the person the information is about, who may be the child, a parent or another adult – because consent “cannot be given”, the school “cannot reasonably be expected to obtain” it, or asking “would prejudice the provision of the protection”; and it is necessary for reasons of substantial public interest. The DfE's second worked example uses it: “the governing body of a maintained school has a statutory duty under section 175 of the Education Act 2002 to safeguard and promote the welfare of children. This might include the processing of special category data, in line with paragraph 18 of Schedule 1 of the DPA, to safeguard children and individuals at risk.”
4. Equality monitoring: Article 9(2)(g) with Schedule 1 paragraph 8. Paragraph 8 covers ethnicity, religion, health and sexual orientation used “for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people”. It is a monitoring condition, not a general one: it cannot be used for measures or decisions about a particular person or where it is likely to cause substantial damage or distress, and it stops applying once a person has given written notice and a reasonable period to stop has passed.

Academies and independent schools. Section 175 of the Education Act 2002 places the safeguarding duty on local authorities and the governing bodies of maintained schools and further education institutions. An academy or independent school takes the equivalent duty from paragraph 7 of the Independent School Standards, made under section 157 of the same Act (a 16 to 19 Academy from section 175(3A)), so its policy document should name those rather than section 175(2).

Two narrower conditions. Explicit consent under Article 9(2)(a) suits only what is genuinely optional, where a refusal costs the pupil or parent nothing; the DfE describes explicit consent as “consent that has been confirmed in a written statement”. Vital interests under Article 9(2)(c) covers an emergency where the person is physically or legally incapable of giving consent – telling paramedics about an unconscious pupil's allergy, for instance. Article 9(2)(f) covers establishing or defending legal claims, which can arise in a tribunal or an insurance claim.

The condition does not have to match the lawful basis. A maintained school's care plan can rest on public task under Article 6(1)(e) and on Article 9(2)(g) with paragraph 6; the staff sickness record on Article 6(1)(b) or (c) and on Article 9(2)(b) with paragraph 1. Decide each pairing in advance and write it down: an Article 9 condition chosen after a complaint arrives is hard to defend.

The appropriate policy document and the record of processing

Almost every school needs an appropriate policy document, because the conditions it relies on most require one. Schedule 1 paragraph 5(1) says: “Except as otherwise provided, a condition in this Part of this Schedule is met only if, when the processing is carried out, the controller has an appropriate policy document in place”. The exceptions are narrow disclosure cases that do not touch ordinary school processing; paragraph 6 (statutory functions), paragraph 8 (equality) and paragraph 18 (safeguarding) have none, and paragraph 1 (employment) imposes the same requirement itself. The ICO's page What are the rules on special category data? sums it up: for the substantial public interest conditions and the employment condition “you must: have an appropriate policy document (unless an exemption applies); and include information about the condition you rely on in your record of processing activities.”

In practice a school's appropriate policy document is short: it lists each Schedule 1 condition the school relies on, the processing each covers, how the school meets each data protection principle for that data (who has access, how it is secured, how accuracy is kept), and a pointer to the retention period for each record type. The periods themselves come from the school's retention schedule, not from the policy document; the pupil records retention guide covers those.

The record of processing. Schedule 1 paragraph 41 adds three fields to the Article 30 record for every processing that relies on a Schedule 1 condition requiring an appropriate policy document: “(a) which condition is relied on, (b) how the processing satisfies Article 6 of the UK GDPR (lawfulness of processing), and (c) whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.” The ICO adds: “You must also identify whether you need an appropriate policy document under the DPA.” The record of processing activities guide covers the rest of the record.

Privacy notices. The privacy notice must name the categories of data and the lawful basis, but the ICO says “You don't have to say which condition you're relying on”. Many schools name it anyway, which does no harm; the privacy notice guide covers the DfE models.

DPIAs. The ICO says “you must carry out a DPIA if you plan to process special category data: on a large scale; to determine access to a product, service, opportunity or benefit; or which includes genetic data or biometric data for the purpose of uniquely identifying someone.” A cashless catering system with fingerprint readers always qualifies; a new safeguarding platform or a wellbeing app that records pupils' moods will usually need one too, and the ICO adds: “If in doubt, you should carry out a DPIA.” The DPIA guide for schools sets out the assessment.

Biometrics, staff data, sharing and breaches

Biometrics need parental consent as well as a condition. In schools and colleges in England and Wales, section 26 of the Protection of Freedoms Act 2012 requires the school to notify each parent before processing a child's biometric information, and section 26(3) says the information must not be processed unless “at least one parent of the child consents” and “no parent of the child has withdrawn his or her consent, or otherwise objected”. Under section 26(5) a child's own refusal or objection stops the processing “irrespective of any consent given by a parent”, and section 26(7) requires “reasonable alternative means” such as a PIN or a card. Sections 26 to 28 extend to England and Wales only. The GDPR in schools guide covers the consent process.

Staff data deserves its own entries. The school is the employer, so sickness records, occupational health reports, reasonable adjustment plans, maternity health and safety assessments and trade union deductions all sit under Article 9(2)(b) and Schedule 1 paragraph 1, and appear in the appropriate policy document and the record of processing beside the pupil data. DBS outcomes and declared convictions sit there too, as criminal offence data.

Sharing and suppliers. Sharing special category data with third parties such as the local authority, the NHS or children's social care needs its own condition, usually the same one the school relies on to hold it; paragraph 18 permits a safeguarding referral without consent where seeking it would prejudice the child's protection. The information sharing agreements guide covers the written arrangements. A supplier that holds the data for the school, such as the MIS, a safeguarding platform or a cashless catering system, is a processor: the school remains the data controller and needs a written contract with it, as the data processing agreement guide explains.

Breaches. A breach involving health, safeguarding or SEND information is more likely to put someone at risk, and Article 33 of the UK GDPR requires the school to report a personal data breach to the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. The school data breach guide covers the test and the log.

Minimise. The ICO says “you must collect and retain only the minimum amount of special category data” needed, and that “one of the considerations for determining the appropriate level of security is the sensitivity of the personal data.” Keep it securely, with access limited to the staff who need it. A medical note copied into three spreadsheets, a class list annotated with diagnoses, or an old allergy form kept after a pupil has left are the usual excesses, and each is a breach waiting to happen.

Special category data in a message

The appropriate policy document describes where the school keeps health and safeguarding information: the MIS, the medical folder, the safeguarding system. A good deal of it arrives somewhere else. A parent texts a teacher on a Sunday evening to say that a child's seizure medication has changed. A teaching assistant posts in the year team's group chat that a pupil has a new diagnosis and needs a quiet space at lunch. A head of year messages the designated safeguarding lead late at night about something a pupil said.

Every one of those messages is special category data, or information the DfE says should be treated as such, and the school is the controller of it. If it sits on a member of staff's personal phone, it is outside the access controls, retention periods and erasure the appropriate policy document promises; it is not in the record of processing; it will not be found for a subject access request; and if the phone is lost, it is a breach the school may not know about.

ComplyChat is designed to keep those conversations where the school controls them. Staff, and parents added by their mobile number, talk in channels the school runs; a mobile number verified by SMS is an identity, so a parent needs no account on the school's systems; and everyone added is told the channel is on the record and can object or leave. On paid plans, once the school's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription, so they can be listed in the policy document like any other system. ComplyChat is not an MIS, a medical record or a safeguarding system, and the care plan and the safeguarding record still belong in the systems your policy names.

A question for the next leadership meeting: where does the message about a pupil's medication go when a parent sends it to a teacher's own phone, and does your appropriate policy document cover that place?

Questions people ask

What qualifies as special category data?

Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data used to identify someone uniquely, data concerning health, and data concerning a person's sex life or sexual orientation, under Article 9(1) of the UK GDPR. An inference about one of those categories also counts where the school sets out to draw it or acts on it.

What is not considered special category data?

Criminal offence data, such as a DBS check outcome, is not special category data, although Article 10 of the UK GDPR applies similar safeguards to it. Financial information, addresses and attendance are not special category either. Nor, in law, are SEN, safeguarding, pupil premium, children in need or looked-after status, but the DfE says it is best practice for schools to treat them as special category data, and they often contain health details that are.

Is SEN or safeguarding information special category data?

Not in itself: neither is listed in Article 9 of the UK GDPR. The DfE's guidance says that “in a school, it would be best practice to also treat as special category data” any personal data about a safeguarding matter, pupils with SEND, pupil premium, children in need and looked-after children. Where a SEN or safeguarding record reveals a pupil's health or other Article 9 details, those details are special category in law and need an Article 9 condition.

Does a school need an appropriate policy document?

Almost always. The conditions in Schedule 1 to the Data Protection Act 2018 that schools use for staff data (paragraph 1), statutory functions (paragraph 6), equality monitoring (paragraph 8) and safeguarding (paragraph 18) are met only if an appropriate policy document is in place when the processing is carried out. It must explain how the school complies with the Article 5 principles and its retention and erasure policies, and be kept, reviewed and made available to the ICO on request.

Which condition does a school use for safeguarding information?

Usually Article 9(2)(g), substantial public interest, with paragraph 18 of Schedule 1 to the Data Protection Act 2018, which covers safeguarding children and adults at risk without consent where consent cannot be given, cannot reasonably be obtained, or seeking it would prejudice the child's protection. The DfE gives this as its example, linked to the section 175 duty for maintained schools; academies and independent schools rely on paragraph 7 of the Independent School Standards, made under section 157 of the Education Act 2002.

Official guidance and your next step

The law is in Article 9 and Article 10 of the UK GDPR, and in section 10 of and Schedule 1 to the Data Protection Act 2018. The ICO's pages What is special category data? and What are the rules on special category data? are the regulator's guidance. The DfE's What data protection means for schools and Data processing a school is permitted to do give the school-specific view, and section 26 of the Protection of Freedoms Act 2012 governs biometrics. Quotations are from those pages as published on 30 October 2026.

This guide covers schools in England, with notes on where the law extends further, and is not legal advice. Your data protection officer should advise on your school's own conditions; the data protection officer guide covers that role.

Then do one thing: open your record of processing, find every line that holds health, ethnicity, religion, biometric or safeguarding information, and check that each names its Article 9 condition, its Schedule 1 paragraph where the condition needs one, and a retention period that matches your appropriate policy document. A blank in any of those three is the first thing to fix.