ESSENTIAL GUIDANCE · BUYER GUIDE · 3 min read
Part of Validate insights →Protecting special category data in applications and services
Identify sensitive information paths and assess access, handling and evidence without treating a technical test as a lawful-basis decision.
Technical review lead: James Hinton · Offensive security lead
Identify sensitive information paths and assess access, handling and evidence without treating a technical test as a lawful-basis decision.
Need an acronym translated?Open the cyber glossary →Identify the information and its sensitivity
Special category data needs particular care because of the nature of the information and possible harm from misuse. Confirm which data falls within the relevant legal categories and where it appears in the service. Health information, for example, can be exposed through an account, an export or a message as well as a primary database. Classification should follow actual processing, not only a table name.
Keep lawful processing and security decisions distinct
ICO guidance explains that special category processing needs an Article 6 lawful basis and an Article 9 condition, with other applicable requirements considered. Technical testing does not supply those grounds. Work with the relevant privacy owner to understand the processing context, then define the security questions the assessment can address without presenting its report as a legal approval.
Trace sensitive information through ordinary workflows
Map creation, viewing, changes, exports, support access, integrations, logs and backups. Identify where information crosses an organisational or supplier boundary. Examine whether staff roles and customer or tenant separation reflect the intended need to know. Pay attention to indirect exposure, such as an attachment or diagnostic record, rather than focusing only on the most obvious screen.
Make test records and evidence safe
Agree controlled accounts and representative records, using synthetic information where it answers the question. Define access to working evidence and how unexpected real information will be escalated. Avoid unnecessary copying into screenshots, reports or shared systems. Active testing requires explicit written authorisation, agreed scope and appropriate supplier permissions; sensitivity is a reason for careful planning, not uncontrolled proof gathering.
Prioritise controls according to credible harm
Investigate whether the right person can access the right record for the right purpose, and whether sensitive operations receive suitable checks. Consider how an account or support-process failure could cross that boundary. Record both the technical condition and the information consequence. A severity label without the affected workflow can leave the owner unable to choose the appropriate correction.
