If you work in the charity sector, there is a very good chance you are processing special category data under Article 9 of the UK GDPR — and an equally good chance you haven't fully addressed what that means for your organisation.
What counts as special category data?
Article 9 covers personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data, and data concerning a person's sex life or sexual orientation. For charities working with vulnerable populations, this isn't edge-case data — it's core to the work.
A domestic abuse charity holds health and safeguarding records. A food bank records information about financial hardship that may correlate with ethnicity or disability. A community organisation supporting refugees processes data about national origin and potentially religious belief. All of this falls within Article 9, and all of it requires a lawful basis for processing that goes beyond the standard Article 6 grounds.
Why consent isn't always the answer
Many small charities default to consent as their lawful basis for processing special category data. It feels intuitive — ask people for permission and you're covered. But consent under GDPR is a high bar. It must be freely given, specific, informed, and unambiguous. In a charity context, where there is often a power imbalance between the organisation and the people it serves, relying on consent can be problematic.
A better approach for many charities is to consider whether processing is necessary for reasons of substantial public interest under Article 9(2)(g), supported by a condition in Schedule 1 of the Data Protection Act 2018. This requires an Appropriate Policy Document to be in place — a requirement that many small charities are unaware of.
What you should do now
Start by mapping the personal data your organisation actually holds. Identify where special category data appears — it is usually more widespread than expected. Then review your lawful bases for processing that data, ensuring you have both an Article 6 and an Article 9 condition for each processing activity.
If you're relying on substantial public interest, draft your Appropriate Policy Document. And if you don't have a Record of Processing Activities that reflects this analysis, that is the first gap to close.
This isn't about generating paperwork for its own sake. It's about understanding what data you hold, why you hold it, and whether your legal basis for doing so is sound. For charities handling sensitive data about vulnerable people, getting this right is both a legal obligation and an ethical one.