ICO updates its special category data guidance, releases two online tools
Published: 29/10/2026
| ICO
The Information Commission (ICO) has updated its regulatory guidance on handling special category data under Article 9 of the UK General Data Protection Regulation (GDPR) to reflect legislative changes introduced by the Data (Use and Access) Act 2025 (DUAA).
Recognising that organisations often struggle to identify the right legal bases for processing sensitive personal data, the ICO has released two new interactive online tools that clarify what organisations must, should, and could do to comply.
The first interactive tool aims to support organisations in navigating the Article 9 conditions governing special category data processing and identify which legal justifications apply to their operations.
The second tool guides organisations through the substantial public interest conditions and helps determine whether any specific exemptions apply to their processing activities.
Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.
GDPR TRAINING
EU GDPR TRAINING
Privacy Engineering Training
EU GDPR Training
US Privacy Law Training
UK GDPR Training
Image credit: PeopleImages
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 3,250 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.