Special categories of personal data

Special categories of personal data specified under the General Data Protection Regulation (2016/679 EU) (GDPR) attract additional protection. An employer can process special category data where this is necessary for the purposes of performing or exercising employment law obligations or rights. The employer must have in place a policy document that explains how it will comply with the principles of the GDPR in relation to the special category personal data and that sets out its policies on retention and erasure of the data.