Which data need extra safeguards?
Choose a record you are about to use. It can fit several cards. Check its contents, purpose, recipients and the harm a person could face. “Hold” is a proposed business decision unless a legal condition is stated.
01 · Contact details, orders and online identifiers
Names, email addresses, ticket histories and identifiable device or customer IDs can be personal data. A public profile can still identify someone.
What to do
Describe the purpose. Document the Article 6 basis, notice, minimum fields, retention and who can see them. Separate support from any later model training. Inspect logs and exports as well as the prompt.
When to hold
Hold repurposing until the new use, compatibility or basis, notices and rights have been assessed.
EU-GDPR · UK-GDPR02 · Face, voice, gait and fingerprints
A photo, recording or signature can be personal data. Specific technical processing of traits for unique identification, such as comparing a voiceprint to authenticate a caller, engages the special-category rule. An ordinary recording used only for transcription requires its own assessment of content and purpose.
What to do
Record whether recognition is necessary, Article 6 basis and Article 9 condition where applicable. Compare a PIN or staffed route. Separate templates from names, tightly limit access, encrypt, test false matches and provide a genuine fallback. Screen for a DPIA and check local biometric rules.
When to hold
Stop biometric enrolment if there is no applicable condition, or if users are offered a supposed consent choice without a genuine alternative. A false match must not automatically expose another person’s account.
EU-GDPR · ICO-BIO · ICO-SPECIAL · UK-SCHED03 · Health, genetic data and intimate information
A symptom, mental-health diagnosis, disability-related clinical note, genotype or sexual orientation can trigger Article 9. A model-generated health score or a label used as a sensitive inference can matter even if wrong.
What to do
Document the purpose, Article 6 basis and precise Article 9 condition. Check national conditions, professional secrecy and sector rules. Remove free text where a simple instruction suffices. Separate clinical staff access from product analytics. Verify vendors cannot reuse it beyond the authorised purpose.
When to hold
No live prompts or training while legal conditions, clinical responsibility or residual high risk are unresolved. A general terms-of-service click is insufficient evidence of valid explicit consent.
EU-GDPR · ICO-SPECIAL · UK-SCHED · EU-SENS · UK-MED04 · Other Article 9 categories and inferred traits
Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership are special categories, as are sex life, sexual orientation, health, genetic data and uniquely identifying biometrics. A name alone need not disclose a belief. Profiling to infer or act on belief warrants a fresh assessment.
What to do
List each trait and intended use separately. Test necessity, proxies, misclassification, unequal treatment and the way a person can correct the record. Check the Member State rules or UK Schedule 1 and the need for an appropriate policy document under particular UK conditions.
When to hold
Pause an audience or risk score built from suspected characteristics until the purpose, lawful route, rights and discrimination risks can be demonstrated.
EU-GDPR · ICO-SPECIAL · UK-SCHED · EU-SENS05 · Criminal convictions, offences and allegations
A conviction or applicable allegation in a screening note raises Article 10. A mere payment anomaly does not establish an offence. The UK statute expressly addresses allegations and proceedings.
What to do
Record Article 6 basis and official authority or the applicable domestic or EU-law authorisation with safeguards. Check UK Schedule 1 and any policy-document requirement or the relevant Member State law. Restrict access and give a way to correct a false match.
When to hold
Hold automated blacklisting or sharing allegations with a customer until authority, accuracy, scope and challenge route are established.
EU-GDPR · UK-SCHED · UK-CRIME06 · Children and young users
Age or contact details do not alone make a child’s record Article 9 data. Children can face lasting harm from profiling, location disclosure and persuasive design. A service aimed at adults may still be likely to be accessed by children.
What to do
Assess the audience, best interests, age-appropriate notices, high-privacy defaults and safe contact. Minimise location and profiling. For an online service offered directly to a child that relies on consent, check Article 8 and applicable national ages. UK threshold is 13 in that context, subject to the statutory exception. EU default is 16 and national law may lower it to no less than 13. Other legal grounds and safeguarding questions need their own analysis.
When to hold
Hold an age-gated launch if the design still exposes children’s locations. Verify authority and safety before disclosing to a parent, teacher or representative.
EU-GDPR · ICO-CHILD · UK-CHILD · ICO-CHLAW07 · Adults at heightened risk, including some older or disabled people
Risk depends on equipment, circumstances, dependence, coercion and the decision. Age, disability or receiving care does not establish incapacity. A communication adjustment can enable a person to decide for themselves.
What to do
Offer phone, text, accessible formats or a named human, as appropriate. Ask what channel is safe and whether help is wanted. Verify a representative’s identity, scope and authority. A shared device can expose an abuse survivor. Screen health information separately. Get local specialist advice if authority or capacity is disputed.
When to hold
Do not infer incapacity from an AI score, or send a sensitive message to a carer merely because they share an address. Escalate an unresolved safeguarding conflict to the designated lead.
EU-GDPR · ICO-SCREEN · ICO-ACCESS08 · Workers, applicants and people reliant on a service
Staff may fear punishment for refusing. Recruitment ranking, patient triage, credit decisions and access to essential services may affect livelihoods even when inputs appear routine.
What to do
Consider power imbalance and a realistic route to refuse. Test accessibility, errors and appeal with people who can reverse a result. Check employment, equality, sector and local consultation duties, including works-council rights where applicable.
When to hold
Hold automatic exclusion until the significant-decision rules, role classification, fairness and effective safeguards are resolved.
EU-GDPR · UK-RIGHTS · EU-HIGH · EU-WORKS09 · Payment, identity, safety and location information
Bank details, tax IDs, passwords and a shelter address can cause fraud or physical harm even when outside Article 9. A government identifier may have additional national protections.
What to do
Tokenise where possible, exclude passwords, secrets and full identity documents from prompts, and restrict exports. Keep contact preferences and locations separate. Ask if anyone could locate, coerce or impersonate a person using the output.
When to hold
Stop deployment if model logs or support exports expose usable credentials, live locations or a person’s safe address. Revoke exposed credentials securely.
EU-GDPR · UK-GDPR · NCSC10 · Confidential, privileged and commercial information
Contracts, unpublished designs, source code, strategy, invention notes and client legal advice can be restricted even without personal data. An identifiable client attachment may put both sets of duties in play.
What to do
Check the client mandate, professional confidentiality, privilege, provider access/reuse, jurisdiction and contractual incident terms. Start with an approved private environment or a redacted fictional extract. For an unpublished invention check disclosure and filing strategy first. Record who authorised sharing and for what.
When to hold
Withhold privileged advice, third-party secrets and unreleased inventions from external tools until the relevant owner and specialist have cleared that use. A promise to delete later cannot undo an unauthorised disclosure.
SRA-CONF · UK-IP · EU-SECRET · ICO-CONTRACT11 · Pseudonyms, synthetic records, logs and model artefacts
Removing names can leave a person identifiable from a rare diagnosis combined with a postcode or a lookup table. Embeddings, prompted model outputs and supplier logs can expose source material. A model trained on personal information needs a case-specific anonymity assessment.
What to do
Examine realistic re-identification and extraction paths, who has additional information and how it can be combined. Keep lookup keys separately. Use fully invented practice data and test whether generated samples recreate real people. Include backups and caches on the retention map.
When to hold
Do not describe records or a model as anonymous until the conclusion and attack assumptions are evidenced. Reopen the assessment if access, recipients or available auxiliary data change.
EU-GDPR · EDPB-MODEL · ICO-ERASE12 · Overlapping categories in a single attachment
A support email includes a child’s name, their parent’s bank details, an accommodation note and a confidential solicitor’s attachment. A label such as “customer support” conceals all four risks.
What to do
Split the ordinary request from the attachments. Route the accommodation to authorised staff and the legal attachment to a restricted matter folder. Show the drafting assistant only the delivery instruction. Test that full-text search, logs and exports cannot reconstruct the excluded material.
When to hold
If the supplier indexes the full mailbox or transmits metadata that reveals the sensitive matter, block the connector and test a smaller source.
EU-GDPR · ICO-SPECIAL · ICO-CHILD · SRA-CONF · NCSCToto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.