UK data protection learning

2.3 Consent, special category data and criminal offence data

Additional safeguards for higher-risk forms of personal data.

What makes consent valid?

It is freely given, with a genuine choice.
It is specific and informed.
It is indicated by a clear affirmative action.
It is separate from unrelated terms where appropriate.
It is recorded so the organisation can demonstrate it.
Withdrawal is as easy as giving consent.

Invalid approach: Pre-ticked boxes, silence, inactivity or unnecessarily making a service conditional on optional consent do not normally produce valid consent.

Special category data

An organisation normally needs:

an Article 6 lawful basis; and
a separate Article 9 condition.

Depending on the Article 9 condition, the organisation may also need to meet a condition in Schedule 1 of the DPA 2018 and may need an appropriate policy document.

Criminal offence data

The organisation needs an Article 6 lawful basis and must have official authority or meet a relevant condition in Schedule 1 of the DPA 2018. Access and retention should be tightly controlled.

Knowledge checkpoint

Answer each question before opening the suggested answer.

1. Why may employee consent be difficult to rely on?

Suggested answer: An imbalance of power can mean the employee does not have a genuine free choice.

2. Is an Article 6 lawful basis alone enough for special category data?

Suggested answer: Normally no. A separate Article 9 condition is also required.

3. Can a person withdraw consent?

Suggested answer: Yes. Withdrawal must be possible and should be as easy as giving consent.

Official reference points

Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.

Learning 2 – Principles and lawful processing