Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what steps her Department is taking to ensure compliance with data protection requirements under the Data (Use and Access) Act 2025 relating to the processing of special category data, including data relating to health and protected characteristics.

All organisations in the UK that process personal data, including government departments, must comply with the UK’s data protection legislation (UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA)). Under the UK GDPR, special category data is personal data that needs more protection because it is sensitive, and so is subject to additional conditions and safeguards.

My department ensures that all processing of special category personal data is undertaken in compliance with data protection legislation. Data Protection Impact Assessments are completed where required and are reviewed by the Data Protection Officer’s team to ensure that special category data is processed only where a valid condition for processing applies, processing is necessary and proportionate, and appropriate technical and organisational safeguards are in place. The Department has published an Appropriate Policy Document on GOV.UK.