Special category data under UK GDPR: how to keep it out of AI

A data protection training quiz asks you to pick the one wrong item from a list: race, sexual orientation, date of birth. The answer is date of birth, and that small question hides a bigger one for any office using AI on staff paperwork.

The nine special categories in Article 9 of the UK GDPR turn up in payslips, fit notes and tribunal bundles without anyone labelling them. Which AI tool your firm may use is a separate decision about the tool itself. This page is about the text you put into it.

Is date of birth special category data? Sorting the usual quiz items

Quiz writers like date of birth as a decoy because it feels private. It is personal data: it helps identify a living person. It reveals no health condition, belief or membership, so Article 9 doesn’t touch it.

The same goes for a home address, a salary or a National Insurance number. These are the details that make a document about someone, which is a different job from revealing something sensitive about them.

Two items catch people out in the other direction. A union line on a payslip and a halal meal request look routine, yet both can reveal a category. The meal request is the one HR teams overlook most easily, in my view. Tick anything below to see where it lands.

The nine categories, and why “revealing” catches more than you’d think

Article 9(1) splits the list in two. Origin, political opinions, beliefs and union membership are caught by data “revealing” them. The other five are caught as such, and biometric data only when it is used to identify someone, which rules out most photos uploaded to a chatbot.

The verb is where offices go wrong. Nobody writes “trade unionist” on a payslip, but the deduction says it. Health is the broadest: a broken wrist on a sick day record counts as much as a psychiatric history, and a GP practice using AI handles little else.

Inference has a test of its own. The ICO’s guidance says an inferred religion or ethnicity may count, depending on whether you intend to draw that inference or to treat someone differently because of it. A prompt to “flag anything about this employee’s background” asks the model for exactly that.

Criminal offence data: Article 10, not Article 9

Article 9 does not mention criminal records, and quiz writers know it. Convictions and offences sit in Article 10, which allows processing only under official authority or where domestic law authorises it. A private employer has no official authority, so it needs a condition from Schedule 1 to the Data Protection Act 2018.

Section 11(2) of the 2018 Act stretches the scope to allegations and to proceedings, including sentencing. A tenant reference mentioning an arrest is in, as is a grievance note recording a caution. I find that wider net more useful to remember than the label itself.

Letting files are a common route out: estate and letting agents see references like that weekly, and an agent asking AI to draft a reply would paste the arrest along with the name.

Schedule 1 conditions and the appropriate policy document

Since 20 August 2025, Article 9(2) opens by requiring that the processing is based on Article 6(1). So the Data (Use and Access) Act 2025 wrote into the article what was already the practice: one lawful basis from Article 6 and one condition from Article 9, never one standing in for the other.

Which condition you use depends on who you are. Employers lean on 9(2)(b), and section 10 of the 2018 Act sends them to paragraph 1 of Schedule 1. A solicitor running a claim relies on 9(2)(f), whose wording since 2025 names tribunals beside courts, and which needs no Schedule 1 condition.

Paragraph 1 brings an appropriate policy document: how the employer meets the Article 5 principles and how long it keeps the data. The Information Commission, which replaced the ICO on 30 September 2026 and still publishes as the ICO, can ask to see it. Many small firms have never written one.

What UK government guidance says about personal data in AI tools

The page many people still quote is the Cabinet Office’s guidance to civil servants: never put sensitive information or personal data into these tools. GOV.UK now marks it as superseded. The current text is the AI Playbook for the UK Government, published by GDS on 10 February 2025.

The Playbook is less blunt and more useful. It asks for a DPIA that identifies all personal data, special category data included, and for the smallest amount of personal data the purpose needs. It also warns that public tools may reuse prompts, so users must be taught what they can enter.

The NCSC said in 2023 that queries to a public LLM are visible to its provider and stored. Nothing here creates an AI exemption, and the EU AI Act doesn’t either. I’d pin the Playbook’s minimisation line above every HR desk.

Business accounts don’t change the Article 9 analysis either. Copilot’s handling of prompts differs from a consumer chatbot’s, but a processor holding health data still holds health data.

A hosted AI gateway that logs prompts is one more processor holding the same health data, with its own retention period to check.

If you’re weighing a private model against a privacy proxy, the condition question travels with you: running the model yourself doesn’t remove the need for an Article 9 condition.

Payslips, fit notes and sickness records: what to cut before AI

Each HR document carries its category in a predictable place. A worker must authorise union deductions in writing under section 68 of the Trade Union and Labour Relations (Consolidation) Act 1992, so the payslip line reflects real membership. Accountants running payroll see thousands of them.

Acas says a fit note is needed after more than seven calendar days off sick. DWP’s guide to the form puts the health condition in field 2. That’s the field an AI summary usually needs, and the name above it the one it doesn’t. Sickness records for NHS staff raise further duties of their own.

Pick a document to see what we’d take out and what can stay. Payroll exports need the column headers checked first, because every identifier tends to have its own column.

Taking out the person: pseudonymised is not anonymous

A label the firm can reverse is pseudonymisation: under Article 4(5) of the UK GDPR, the data can’t be tied to a person without extra information kept separately. Your firm holds that information, so for you the note is still health data. Our UK pseudonymisation guide works through the test.

What changes is what the provider receives. A diagnosis attached to PERSON_1 says much less than one attached to a named warehouse supervisor. Calling the result “anonymised” in a DPIA would be wrong, and the difference between deidentified, pseudonymised and anonymised is worth getting straight before anyone writes that word.

Context gives people away too: “the only union rep at the Quillmere Joinery Ltd site in Hull” needs no name. We made that firm up, as everything in the example below. Some tools that restore names keep the originals in a store of their own, as LLM Guard does with its vault.

Before a note goes anywhere, paste it into the box below. It flags the numbers people miss, such as NI numbers, NHS numbers, postcodes and UK phones, the same way you would check a passport copy for its number.

Developers calling a model from their own code can strip identifiers at a gateway on their own server before any request leaves the building.

Special category data in an HR file: before anyone pastes it

The checklist below is the whole routine in eight ticks. If two or more stay empty, the note isn’t ready, and I’d rather the summary waited a day. Your AI acceptable use policy is where the routine belongs once it works.

A health note that leaks with a name attached can also raise an insurance question; cyber cover for UK small firms differs widely on data incidents. This page explains the law in general and isn’t legal advice for your file.

For HR teams who need the diagnosis kept but the employee left out, Nonimo for UK offices replaces names, dates of birth and contact details with labels on your own computer before the note reaches the AI.

Sources

• ICO, Special category data: the nine categories, the inference test, criminal data outside the definition, five conditions needing Schedule 1 or A1.
• UK GDPR, Article 9 (legislation.gov.uk): the nine categories; “based on Article 6(1)” and “or tribunals” inserted from 20 August 2025.
• Data Protection Act 2018, Schedule 1 (legislation.gov.uk): paragraph 1 employment condition; paragraph 5 and Part 4 on the appropriate policy document; Part 3 for criminal convictions; “Commission” substituted from 30 September 2026.
• DCMS, Information Commission succeeds the ICO (GOV.UK): the Information Commission took over from the ICO on 30 September 2026.
• GDS, AI Playbook for the UK Government (GOV.UK): DPIAs naming special category data, data minimisation, what users may enter in public tools.
• NCSC, ChatGPT and large language models: what’s the risk?: queries visible to the provider and stored; keep sensitive information out.
• Courts and Tribunals Judiciary, AI judicial guidance, October 2025: no private information in public AI tools.
• Acas, Fit notes and proof of sickness: fit note after more than seven calendar days; who can issue one.

Accessed 8 November 2026.