Key takeaway
A low-confidence health inference can still need special-category review when the system intends to draw or act on it.
Begin with what the field is used to reveal
An operational archive can contain sensitive information without a column called health. A maintenance note may explain an employee’s injury; a service label may be produced to infer disability. Start by describing what each field says, what a transformation is intended to infer and how the proposed recipient will use it. A technical label such as score does not answer those questions.
ICO guidance distinguishes ordinary identifiers from information revealing protected categories. Its inference guidance addresses intended sensitive inferences and treatment based on them, even when confidence or accuracy is low. The pages were read on 11 October 2026 and are marked under review following the Data (Use and Access) Act 2025. This UK review agenda is not a current transaction clearance or an automated-decision-law assessment.
Complete a field-and-purpose map
This hypothetical maintenance-app review concerns four proposed fields. The company has not exported any real records. Its reviewer separates the information present in a field from an intended use by a recipient. The last column identifies the next decision, rather than certifying a lawful basis or pretending the example establishes anonymity.
The equipment measurement has no person link under the stipulated example. That assumption must be tested against the real schema: a supposedly machine-only record could also reveal who operated the equipment or where they worked. Classification is a property of the actual information and context, not a permanent badge assigned to its filename.
| Hypothetical field and use | Review finding | Next decision |
|---|---|---|
| Pump pressure; no person link | Equipment measurement on the stated facts | Confirm no identifying linkage in the proposed package |
| Employee note: injury requires step-free access | Direct information concerning health | Hold the narrative for sensitive-data review |
| Customer name for account matching | Identifier; no intended sensitive inference here | Apply ordinary personal-data review |
| Model score intended to infer disability | Sensitive inference despite low confidence | Hold the score and its proposed treatment for review |
Do not remove the label and keep the same purpose
In the example, an engineer proposes renaming disability_risk to service_priority. The receiving product would still rank customers by the same inferred condition. The review remains unresolved because the purpose and effect have not changed. Likewise, deleting the injury sentence while retaining a score derived from it does not demonstrate that the new package is free of the original sensitive inference.
A practical lineage note should name the inputs, transformation, output and intended decision. Record whether the recipient wants to infer a sensitive attribute, use an already inferred attribute, or perform a purpose that does neither. If the purpose is unknown, ask for a precise description before preparing a sample. The completed map should be updated when a proposed product feature changes.
Check the additional condition separately
The ICO’s rules page explains the need for an Article 6 lawful basis and an applicable Article 9 condition, with relevant UK requirements for certain conditions. Ordinary commercial usefulness does not supply the missing condition. A research description should identify the actual activity and applicable safeguards; writing research beside a licensing proposal is not an approval.
Assign the unresolved question to the person responsible for privacy and legal review. Give them the field map, proposed purpose, affected people, collection context, retention plan and known restrictions. Ask whether a narrower package can meet the legitimate business question without the sensitive input or output. Do not circulate real health narratives to a potential recipient merely to ask whether they are useful.
Treat voice, images and financial fields precisely
A photograph is not automatically special-category biometric data simply because it depicts a person. The ICO distinguishes the specific processing and identification purpose involved. For a proposed voice or image matching feature, describe the extraction and intended identification operation; a file format alone is insufficient. Financial information is not one of the listed special categories, but that does not remove ordinary privacy, confidentiality or sector obligations.
The useful internal result is a set of classified questions with named owners: direct health text held, intended sensitive inference held, ordinary identifiers reviewed under their own purpose, and machine-only measurements checked for linkage. Keep an unknown category when the source or transformation is missing. A confident statement that there is no sensitive information requires evidence of the fields and intended uses actually examined.
Use the map to choose a smaller next step
For the hypothetical app, the company can discuss an approved description of equipment measurements while the employee narrative and disability score remain excluded. That decision does not authorize a real sample or a license. Rights & privacy review can organize the outstanding questions, and Readiness can assign an owner and next action; neither tool determines the lawful condition.
Before a VOID introduction, approve the named recipient and the exact metadata to be disclosed. Decide any later sample and commercial use separately. Keep the field map attached to those decisions so an exclusion is not silently lost when someone prepares a larger export. The goal is a reviewable scope, with the unresolved sensitive purpose visible to the person empowered to decide it.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.