Keeping the personal data organisations handle safe is nothing new. But with the GDPR do the special categories of data need to be handled any differently?