Data Protection Act 2018 (c. 12)

SCHEDULES

SCHEDULE 1 U.K. Special categories of personal data and criminal convictions etc data

PART 1 U.K. Conditions relating to employment, health and research etc

Employment, social security and social protection U.K.

1 (1) This condition is met if— U.K.

(a) the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection, and

(b) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2) See also the additional safeguards in Part 4 of this Schedule.

(3) In this paragraph—

• “social security” includes any of the branches of social security listed in Article 3(1) of Regulation (EC) No. 883/2004 of the European Parliament and of the Council on the co-ordination of social security systems (as amended from time to time);

• “social protection” includes an intervention described in Article 2(b) of Regulation (EC) 458/2007 of the European Parliament and of the Council of 25 April 2007 on the European system of integrated social protection statistics (ESSPROS) [F1 as it had effect in EU law immediately before [F2 IP completion day]].

Textual Amendments

F1 Words in Sch. 1 para. 1(3) substituted (31.12.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 3; 2020 c. 1, Sch. 5 para. 1(1)

F2 Words in Sch. 1 para. 1(3) substituted (15.12.2021) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2021 (S.I. 2021/1300), regs. 1, 2

Commencement Information

I1 Sch. 1 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Health or social care purposes U.K.

2 (1) This condition is met if the processing is necessary for health or social care purposes. U.K.

(2) In this paragraph “health or social care purposes” means the purposes of—

(a) preventive or occupational medicine,

(b) the assessment of the working capacity of an employee,

(c) medical diagnosis,

(d) the provision of health care or treatment,

(e) the provision of social care, or

(f) the management of health care systems or services or social care systems or services.

(3) See also the conditions and safeguards in Article 9(3) of the [F3 UK GDPR] (obligations of secrecy) and section 11(1).

Textual Amendments

F3 Words in Sch. 1 para. 2(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 91(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I2 Sch. 1 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Public health U.K.

3 U.K. This condition is met if the processing—

(a) is necessary for reasons of public interest in the area of public health, and

(b) is carried out—

(i) by or under the responsibility of a health professional, or

(ii) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

Commencement Information

I3 Sch. 1 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Research etc U.K.

4 U.K. This condition is met if the processing—

(a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,

(b) is carried out in accordance with [F4 Article 84B of the UK GDPR], and

(c) is in the public interest.

Textual Amendments

F4 Words in Sch. 1 para. 4(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 87(2)(b), 142(1); S.I. 2026/82, reg. 2(o)

Commencement Information

I4 Sch. 1 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)