# Lawful basis for processing and special category data

> **Key takeaway:** One Art 6 basis required for all processing; an additional Art 9 condition (plus, often, a DPA 2018 appropriate policy document) required for special category data; Art 10 governs criminal offence data via official authority or a Sch.1 condition. Document the basis before processing starts.

- **Jurisdiction:** England & Wales
- **Practice area:** Commercial
- **Last reviewed:** 2026-09-05
- **Interactive page:** https://www.kttclegal.info/library/notes/Commercial/lawful-basis-and-special-category-data
- **Keywords:** lawful basis, Article 6, Article 9, special category data, criminal offence data, consent, legitimate interests, appropriate policy document, UK GDPR

## What is this about?

Every act of processing personal data under the UK GDPR needs a lawful basis under Article 6. Where the data is 'special category' (revealing race, health, sexual orientation, and similar sensitive characteristics) or criminal offence data, a second, additional condition is needed under Article 9 or the Data Protection Act 2018 (DPA 2018) before processing is lawful.

## What is the core rule?

Article 6(1) UK GDPR lists six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Only one basis is needed and it must be identified and documented before processing starts. For special category data, Article 9(1) prohibits processing unless one of the Article 9(2) conditions applies (e.g. explicit consent, employment/social security law, or substantial public interest), and several of the UK-specific Art 9(2)(g)-(j) conditions require an appropriate policy document under DPA 2018 Sch.1 Part 4. Criminal offence data is governed separately by Article 10 and DPA 2018 s.10 and Sch.1, and generally requires official authority or a specific condition.

## What are the elements or test?

1. Identify the category of data: ordinary personal data, special category data (Art 9), or criminal offence data (Art 10)
2. For ordinary personal data: select and document one Art 6(1) basis before processing begins
3. For special category data: identify an Art 9(2) condition in addition to the Art 6 basis
4. If relying on a DPA 2018 Sch.1 condition for special category or criminal offence data, check whether an appropriate policy document is required
5. For criminal offence data: identify a lawful authority basis or DPA 2018 Sch.1 condition
6. Document the basis and condition in the record of processing activities and, where relevant, the privacy notice

## Which authorities matter?

- **UK GDPR, Art 6** — Sets out the six lawful bases; exactly one must apply to each processing purpose.
- **UK GDPR, Art 9** — Prohibits processing of special category data save under a listed condition.
- **Data Protection Act 2018, s.10 and Sch.1** — Supplies the UK-specific conditions for Art 9 special category processing and Art 10 criminal offence data, several requiring an appropriate policy document under Sch.1 Part 4.
- **UK GDPR, Art 10** — Restricts processing of personal data relating to criminal convictions and offences to processing under official authority or a specific legal basis.

## How does this apply in practice?

This note maps the basis-selection framework; it does not catalogue every DPA 2018 Sch.1 condition in detail, and does not address the separate law enforcement processing regime in DPA 2018 Part 3. Consent as a lawful basis has its own strict validity requirements (freely given, specific, informed, unambiguous, and withdrawable) which are not developed here. Employment contexts often engage both Art 6 (contract/legal obligation) and Art 9 (health, trade union membership) simultaneously — see also employment monitoring considerations, which are outside this note's scope.

## What are common pitfalls?

- Treating consent as the default or safest basis when another basis (contract, legitimate interests) is more appropriate and more robust
- Relying on legitimate interests without conducting and documenting the three-part legitimate interests assessment (purpose, necessity, balancing test)
- Processing special category data under an Art 9(2) condition without also verifying an Art 6 basis applies
- Failing to prepare the appropriate policy document required by several DPA 2018 Sch.1 conditions
- Assuming employee consent is freely given, when the employment power imbalance usually makes another basis more defensible

## When would a practitioner use this?

Foundational check at the start of any data protection compliance review, DPIA, or dispute over the legality of a specific processing activity — establishing whether a lawful basis (and, where relevant, an Art 9/10 condition) was properly identified and documented.

## Quick reference

One Art 6 basis required for all processing; an additional Art 9 condition (plus, often, a DPA 2018 appropriate policy document) required for special category data; Art 10 governs criminal offence data via official authority or a Sch.1 condition. Document the basis before processing starts.

---

*Reference material from [KTTC Legal](https://www.kttclegal.info/), not legal advice. Work product supports instructing solicitors and barristers under their supervision. England & Wales.*