Special category data

Processing special category data (health, racial or ethnic origin, religious beliefs, and so on, as covered in Section 1) needs both an Article 6 lawful basis and a separate Article 9 condition, for example explicit consent, employment law obligations, or substantial public interest.

This "two-basis" requirement is one of the most commonly missed points in data protection: having a lawful basis under Article 6 alone is not enough when the data is special category. Criminal offence data has its own similar regime under Article 10.