Information relating to an employee's health, including their mental health, is special category data under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018). The employer will therefore need to ensure that it is processed lawfully, which means (among other things) ensuring that: • the data protection principles are complied with • there is a lawful condition for processing under Article 6(1) of Regulation (EU) 2016/679, GDPR and a specific condition for processing under Article 9(2) of Regulation (EU) 2016/679, GDPR • subject to any exemptions, the individual’s rights as a data subject are satisfied For further information, see Practice Notes: • Employee health information—data protection issues • The