1. Section 1: Understanding UK data protection law

1.2. 1.2 Personal data and protected categories

UK data protection learning

1.2 Personal data and protected categories

Recognising personal, special category and criminal offence data.

Personal data

Personal data is information relating to an identified or identifiable living person. A person may be identified directly, such as by name, or indirectly by combining information such as an identification number, location information, online identifier or characteristics.

ExampleWhy it may be personal data
Name and home addressDirectly identifies and locates a person.
Student or employee IDLinks to a particular individual in the organisation's systems.
IP address or device identifierMay identify or single out a user when combined with other information.
CCTV imageMay show an identifiable living person.

Special category data

This is personal data that needs additional protection because misuse may create significant risks to rights and freedoms. It includes data revealing:

  • racial or ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • genetic data;
  • biometric data used to uniquely identify a person;
  • health data; and
  • data concerning a person's sex life or sexual orientation.
Important distinction: Information can be highly sensitive without being legally defined as special category data. Bank details and salary records are sensitive personal data, but they are not automatically special category data.

Criminal offence data

Personal data about criminal convictions and offences has separate legal safeguards. Organisations need an Article 6 lawful basis and must also satisfy the relevant additional rules.

Activity: Classify the records

For each item, decide whether it is ordinary personal data, special category data, criminal offence data, or not personal data in the circumstances.

  1. A named learner's attendance percentage.
  2. A staff member's medical certificate.
  3. A list of anonymous website totals that cannot identify or single out anyone.
  4. A DBS result linked to an applicant.
  5. A fingerprint template used to authenticate a named employee.
Open the answer guidance
  • Attendance percentage: personal data.
  • Medical certificate: special category health data.
  • Truly anonymous totals: not personal data, provided re-identification is not reasonably possible.
  • DBS result: criminal offence data and potentially other personal data.
  • Fingerprint template used for unique identification: special category biometric data.

Official reference points

Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.