In detailWhat does the UKGDPR say?What does the DPA 2018 say?What is the combined effect of these rules?How do the conditions work?What does ‘necessary’ mean?How does this affect our lawful basis?Do we need to do a DPIA?What else do we need to do?What does the UKGDPR say?Article 9 prohibits the processing of special category data. There are 10 exceptions to this general prohibition, usually referred to as ‘conditions for processing special category data’:(a) Explicit consent(b) Employment, social security and social protection (if authorised by law)(c) Vital interests(d) Not-for-profit bodies(e) Made public by the data subject(f) Legal claims or judicial acts(g) Reasons of substantial public interest (with a basis in law)(h) Health or social care (with a basis in law)(i) Public health (with a basis in law)(j) Archiving, research and statistics (with a basis in law)Five of the conditions only apply if your processing has an authorisation or basis in EU or member state law. In the UK, th...
