DAT-024 Special Category and Criminal Conviction Data
Description
Every processing activity in the records of processing carries a screening result for special category personal data and for criminal conviction and offence data. Where special category data is present the entry names the condition relied on to lift the prohibition and the necessity assessment behind it. Where criminal conviction and offence data is present the entry names the official authority or the law that authorises the processing and the safeguards that law provides. No comprehensive register of criminal convictions is held. Processing does not begin or continue on an activity where the screening result is absent or the condition it relies on has lapsed.
Rationale
Special category and conviction data arrive through the side doors: occupational health records in human resources, a support attachment a customer pastes into a ticket, a free-text field a product team added. Screening every activity rather than every system is what catches them. Recording the condition against the activity keeps the screening auditable a year later. DAT-019 holds the Article 6 basis, DAT-006 the records of processing, DAT-013 the impact assessment that a high-risk special category activity triggers and AIG-014 the AI training and evaluation case. Issued in S4 on the product owner decision of 2026-09-14, closing EX-22.
Applicability (9 profiles)
Framework Mappings (4)
Evidence (2)
Records of processing showing, for each activity, the special category and conviction data screening result and, where either is present, the condition relied on with its necessity assessment or the authorising law and its safeguards.
Example: Records of processing activities extract of 2026-08-28 covering 41 activities across product, support and human resources, each carrying a screening result and, for the seven flagged activities, the named condition and the necessity assessment reference
Test: Take the records of processing. Verify: (1) every activity carries a screening result rather than a blank, (2) activities outside the product, including human resources, recruitment and support, are present and screened, (3) each flagged activity names a condition and points to a dated necessity assessment, (4) conviction data activities name the authority or the law and its safeguards, (5) no activity flagged as special category is live without a condition.
Output of a data discovery or classification scan across production stores reporting attributes that indicate special category or conviction data, with each finding traced to a screened activity or raised as an exception.
Example: Data discovery scan report of 2026-08-05 over the production databases, object storage and support ticket store, listing 12 attributes matching health, biometric and conviction classifiers with the activity each was traced to
Test: Run the discovery scan over production stores. Verify: (1) the scan covers the stores named in the processing inventory, including support and ticketing systems, (2) every finding is traced to an activity that the records of processing already screen as special category or conviction data, (3) any finding with no matching activity is raised as an exception with an owner and a date, (4) the classifiers cover the Article 9 categories and conviction data rather than a generic personal data pattern.
Questions (3)
Is every processing activity screened for special category personal data?
Every activity means human resources, recruitment, support and marketing as well as the product. Answer no if screening has been done for the product only.
Which of the following are recorded against an activity that involves special category or criminal conviction data?
The screening result is recorded whether it is positive or negative, so that an unscreened activity is distinguishable from a clean one. Conviction data is treated separately from the Article 9 categories because a different test applies to it.
When is an activity screened?
Options run from strongest to weakest. The change trigger is what catches the new free-text field or the new data source that turns a screened-clean activity into a flagged one.