The following are special category data under UK GDPR Art 9 and require a Schedule 1 condition:
- Health / medical information (allergies, conditions, medication)
- Religious beliefs (relevant in our context — but minimise)
- Racial or ethnic origin
- Sexual orientation
- Genetic / biometric
- Trade union
- Data concerning criminal convictions (DBS-related)
For each special category dataset we hold, the Records of Processing Activities (ROPA) must record:
- The data point
- The Article 9 / Schedule 1 condition relied on
- Why it’s necessary
- Who can access it
- Retention
For Jesus Youth, the most common Schedule 1 conditions used will be:
- Para 18 — Safeguarding of children and individuals at risk
- Para 8 — Equality of opportunity (rare)
- Explicit consent (for media, for medical info on a consent form)
A DPIA (Data Protection Impact Assessment) is required where processing is likely to result in high risk — e.g. systematic monitoring of children, large-scale special category processing. Standing consent at programme level is generally below DPIA threshold, but a residential with significant medical data may warrant one.