Records of processing activities under UK’s data protection law

Further requirements for special categories of data

When special categories of personal data are processed, using the appropriate special legal bases, the following information must also be included in the record of processing activities:

1. on which legal basis one relies
2. how the processing complies with Article 6 of the GDPR (lawfulness of processing) and
3. if the personal data is retained and deleted in accordance with the required retention and deletion policy and, if not, the reasons for such non-compliance.