The Data Protection (Processing of Sensitive Personal Data) Order 2000
The first data protection principle set out in paragraph 1 of Schedule 1 to the Data Protection Act 1998 prohibits the processing of sensitive personal data unless one of the conditions in Schedule 3 to the Act is met. The condition set out in paragraph 10 of that Schedule is that the processing of sensitive personal data is carried out in circumstances specified by the Secretary of State. The Schedule to this Order specifies ten such circumstances.