Flowchart text description

Question 1: “Do you need to process special category data?”

• If no, you do not need to consider any of the conditions.
• If yes go to Question 2.

Question 2: “Are you considering the explicit consent condition?”

• If yes, then to work out if this is appropriate, see our guidance on the explicit consent condition.
• If no then go to Question 3

Question 3: “Does the Article 9 condition say that it requires authorisation by law or a basis in law?”

• If no then this means you are considering vital interests, not-for-profit bodies, made public by the data subject or legal claims and judicial acts as a condition for processing.
  
  To see if any of these conditions are for processing is appropriate, we have guidance on: vital interests; not-for-profit bodies; made public by the data subject and legal claims and judicial acts.
  
  You don’t need a DPA Schedule 1 condition, or an appropriate policy document.

• If yes then this means you are considering: employment, social security and social protection; health and social care; public health; archiving, research and statistics or substantial public interest as a condition for processing. Go to Question 4.

Question 4: Are you considering the “employment, social security and social protection” condition?

• If yes then you need to work out if this is appropriate, see our guidance on the employment, social security and social protection condition. The relevant legal authorisation is set out in the DPA, at Schedule 1 condition 1. You need an appropriate policy document.
• If no go to Question 5.

Question 5: “Are you considering the “health and social care” condition?”

• If yes then To work out if this is appropriate, see our guidance on the health and social care condition. The relevant basis in UK law is set out in the DPA, at Schedule 1 condition 2. You don’t need an appropriate policy document.
• If no then go to Question 6.

Question 6: “Are you considering the “public health” condition?”

• If yes then “To work out if this is appropriate, see our guidance on the public health condition.
• The relevant basis in UK law is set out in the DPA, at Schedule 1 condition 3. You don’t need an appropriate policy document.”
• If no then go to Question 7.

Question 7: “Are you considering the archiving, research and statistics condition?”

• If Yes then to work out if this is appropriate, see our guidance on the archiving, research and statistics condition. The relevant basis in UK law is set out in the DPA, at Schedule 1 condition 4. You don’t need an appropriate policy document.
• If no then go to Question 8.

Question 8 : “Are you considering the substantial public interest condition?”

• If yes To work out if this is appropriate, see our guidance on this condition. The relevant basis in UK law is set out in the DPA, at Section 10(3). You need to meet one of the 23 specific substantial public interest conditions in Schedule 1 (at paragraphs 6 to 28). In almost all cases, you must also have an appropriate policy document.