Special rules apply for processing sensitive data (now called Special Categories of Data) and criminal convictions and offences. Special Categories of Data include information on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health (physical or mental), sex life, sexual orientation, genetic data and biometric data used to identify a specific individual.

Lawful processing

To lawfully process special categories of data, you must have:

• A lawful ground for being able to process the data
• An additional ground to process it under UK GDPR rules
• The following in place:
• A policy that deals with how this data will be processed (such as in a data protection/privacy standards policy)
• A policy that deals with how long you will keep all the personal data you have processed and when it is likely to be deleted.

You must also ensure that these policies are maintained, reviewed and updated when necessary, from the date processing begins up to 6 months after it ends, and you keep a record of the processing activities.

It is unlikely that you will process information about criminal convictions and offences but will need to use sensitive personal data when undertaking a right to rent check.