← All posts
Exclude by default
Personal data that must never leave: a checklist
Some records are too sensitive to license at all, and UK GDPR names most of them.
Where the list comes from
- Article 9 UK GDPR: special category data.
- Article 10: criminal offence data.
- Good practice: children's data, HR files and private messages.
How we enforce it
Exclusions are agreed system by system before processing starts, then checked again when the output is tested. See data safety.
Key takeaways
- Special category data stays out.
- Private and HR messages excluded by default.
- Check exclusions again at testing.
Sources
- UK GDPR Articles 9 and 10
What could your company's records earn?
A free, nine-question estimate. No files, no logins.
More in Privacy & law
Data brokers and national security: what the UK government is asking
DSIT's 2025 call for evidence asked how brokers keep data away from hostile actors. What it covered, and the checks every broker should run now.
The motivated intruder test, step by step
The ICO's benchmark for whether de-identified data is safe: a determined, competent person with no special access.
The Data (Use and Access) Act 2025: what changed for UK businesses
The UK's 2025 data law reforms, in brief: recognised legitimate interests, complaints duties and more.