Skip to content
The SAVVI Information Governance Framework
Special Category or Criminal Offence Information
1
The UK GDPR defines special category data as:
2
… you can only process special category data if you can meet one of the specific conditions in Article 9 of the UK GDPR. You need to consider the purposes of your processing and identify which of these conditions are relevant.
There are no rows in this table
1
This covers a wide range of information about offenders or suspected offenders in the context of:
It includes not just data which is obviously about a specific criminal conviction or trial, but may also include personal data about:
It also covers a wide range of related security measures, including
It does not cover information about other individuals, including victims and witnesses of crime. However, information about victims and witnesses is likely to be sensitive, and controllers should take particular care when processing it.
2
… you can only process criminal offence data if the processing is either:
There are no rows in this table
Steps
2
Determine if the data reveals Special Category or Criminal Offence Information
Read the ICO guidance and decide if the data reveals Special Category or Criminal Offence Information
3
Cater for Special Category Information
If the data fits the definition of Special Category Information, read the ICO guidance to determine of any of the specific conditions in Article 9 of the UK GDPR are met.
4
Cater for Criminal Offence Information
If the data fits the definition of Criminal Offence Information, read the ICO guidance to determine
Official Authority?
Types of Organisations which are official authorities are listed in .
A part of a local authority performing a particular law enforcement function, such as
may be included, but in general a Local Authority is not a law enforcement Competent Authority.
Conditions for processing Criminal Offence Data
If the Organisation is not a 'official authority', you can check if the Purpose meets one of the conditions laid out in which allows the processing.
Note the condition, and justify why using this data for the Purpose is necessary.
5
Policy Documents
also defines the circumstances where 'Additional Safeguards' are required, such as encryption, retention, erasure.
Organisations may choose to contain the Appropriate Policy Document and Additional Safeguards in a single general Data Protection Policy.
6
No Lawful Basis?
If the data fits the definitions of
data, but the extra conditions cannot be met, the data processing cannot continue.
There are no rows in this table
Want to print your doc?
This is not the way.
This is not the way.
Try clicking the ⋯ next to your doc name or using a keyboard shortcut (
CtrlP
) instead.