GDPR Sensitive Personal Data: Rules, Exceptions, and Penalties

Under the GDPR, sensitive personal data refers to a defined set of categories the regulation calls “special categories of personal data,” and organizations are prohibited from processing any of it unless a specific legal exception applies. The list includes health, biometric, and genetic information along with data revealing race, political opinions, religion, trade union membership, and sexual orientation. Violations sit in the GDPR’s top fine tier: up to €20 million or 4% of worldwide annual turnover, whichever is higher.¹

What Counts as Sensitive Personal Data

Article 9(1) draws the list. Processing is banned for data that reveals a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as for genetic data, biometric data used to uniquely identify someone, health information, and data concerning sex life or sexual orientation.²

Several of these categories have formal definitions. Genetic data means information derived from analyzing a biological sample that reveals something unique about a person’s physiology or health. Biometric data means data from technical processing of physical or behavioral characteristics that can confirm identity, such as facial recognition templates or fingerprint scans. Health data covers anything related to physical or mental health, including records held by healthcare providers.³

Biometric Data Has a Purpose Threshold

Not every use of biometric data falls under Article 9. The restriction applies specifically to biometric data processed “for the purpose of uniquely identifying a natural person.”² The Dutch Data Protection Authority draws a working line: a system that verifies you are who you claim to be, like unlocking a phone with your fingerprint, is treated differently from one that picks your face out of a crowd. Identification triggers Article 9. Pure authentication may not, depending on how the system works.⁴

Inferred Data Can Also Be Sensitive

Ordinary-looking data can become sensitive when it reveals something about a protected category. The Court of Justice of the European Union has held that any personal data “liable indirectly to reveal sensitive information” falls within Article 9’s scope. A spouse’s name on a public interest declaration, for example, could reveal sexual orientation. Where an organization deliberately draws inferences about protected characteristics, or treats people differently based on such inferences, that data gets the same protection as explicitly sensitive data.² Compliance programs often miss this. Databases get audited for obvious fields like “religion” or “diagnosis” while the combinations that reveal the same facts indirectly go unreviewed.

The Default Ban on Processing

The starting position under Article 9 is a blanket prohibition. Processing sensitive personal data is unlawful unless the organization can point to one of ten specific exceptions.² That is the opposite posture the GDPR takes toward ordinary personal data such as names or email addresses, which can be processed under six standard legal bases in Article 6. For sensitive data, the answer defaults to no.

“Processing” is also broader than most people assume. The GDPR defines it to cover any operation performed on data: collecting, storing, organizing, retrieving, sharing, combining, or deleting it.³ Sensitive data sitting untouched on a backup server is still being processed. Any contact with the data brings the prohibition into play.

Exceptions That Allow Processing

Article 9(2) sets out ten exceptions. Each is narrow, and the organization has to prove it qualifies. Documenting the legal basis before processing begins is one of the first things a regulator will ask for.

Explicit consent. The individual gives a clear, affirmative statement specifically agreeing to the processing of their sensitive data for stated purposes. A buried checkbox in terms of service will not do. The consent has to name the sensitive data and explain how it will be used.
Employment, social security, and social protection. Processing is allowed when necessary to carry out obligations under employment or social protection law, such as payroll taxes, disability accommodations, or workplace safety reporting.
Vital interests. Processing is permitted when the person is physically or legally unable to consent and their life is at risk, for instance during a medical emergency.
Non-profit bodies. Organizations with a political, philosophical, religious, or trade union purpose may process their members’ sensitive data, provided the data stays inside the organization and is not shared externally without consent.
Data made public by the individual. If someone voluntarily makes their sensitive information publicly available, the prohibition may no longer apply to that specific data.
Legal claims. Processing is allowed when necessary to bring, defend, or exercise legal claims, or when courts are acting in a judicial capacity.
Substantial public interest. Processing is permitted when required by EU or national law for reasons of substantial public interest, with proportionate safeguards in place.
Health and social care. Processing for preventive or occupational medicine, medical diagnosis, health or social care treatment, or managing healthcare systems is allowed when authorized by law or a contract with a health professional.
Public health. Processing for public health purposes, such as protecting against serious cross-border health threats or ensuring the safety of medicines, is permitted under national or EU law with safeguards including professional secrecy.
Archiving, research, and statistics. Processing for public-interest archiving, scientific or historical research, or statistical purposes is allowed when authorized by law with appropriate safeguards.

Each of these requires documented evidence that the processing is proportionate and necessary for its stated goal.²

Why Consent Is Harder Than It Looks

Explicit consent for sensitive data is a higher bar than standard GDPR consent. Standard consent can sometimes be inferred from context or bundled with other agreements. Explicit consent cannot. The person must specifically agree to the processing of their sensitive data for clearly identified purposes, and EU or national law can declare that even explicit consent is insufficient to lift the ban in certain cases.²

Employment is where this creates the most trouble. The European Data Protection Board has said employee consent to employer data processing is “unlikely to be freely given” because of the power imbalance between the parties. An employee worried about their job or retaliation is not in a position to refuse freely. The EDPB’s guidance tells employers that consent should generally not be their legal basis for workplace data processing; the employment law exception or another ground should be used instead.⁵

Criminal Conviction Data Is Handled Separately

Criminal conviction data does not sit under Article 9. Article 10 handles it, with similarly tight restrictions. Processing data about criminal convictions, offenses, or related security measures is permitted only under the control of an official authority or when specifically authorized by EU or national law with appropriate safeguards. Any comprehensive register of criminal convictions can only be maintained by an official authority.⁶

In practice, a private employer cannot build or maintain a database of employees’ criminal records without specific legal authorization. Background checks, internal blocklists, and sharing of conviction data between companies all need a clear legal basis under national law. The details vary significantly across EU member states, since each country has enacted its own legislation defining when private organizations may process this data.

Automated Decisions Using Sensitive Data

The GDPR already restricts fully automated decisions that significantly affect people, such as algorithmic hiring or credit scoring. Article 22(4) adds a further layer for sensitive data: automated decisions generally cannot be based on special category data at all. Only two of the ten Article 9(2) exceptions can justify it, explicit consent and substantial public interest, and even then the organization must have suitable safeguards protecting the individual’s rights.⁷

Where such decisions are permitted, the person keeps the right to request human review, express their point of view, and contest the outcome. These safeguards are mandatory. An algorithm that rejects a loan based on health data has to allow for a human to review the decision if the applicant challenges it.

When You Need a Data Protection Officer

Organizations whose core activities involve processing sensitive data on a large scale must appoint a Data Protection Officer. Article 37 makes this mandatory in three situations: when processing is carried out by a public authority, when core activities require regular and systematic large-scale monitoring of individuals, or when core activities involve large-scale processing of special category data under Article 9 or criminal conviction data under Article 10.⁸

The GDPR does not fix a precise threshold for “large scale.” Supervisory authorities have pointed to factors such as the number of individuals affected, the volume of data, how long processing continues, and the geographic reach of the operation. A hospital processing patient records across a region clearly qualifies. A single doctor’s office with a local patient base likely does not. The assessment is fact-specific, and getting it wrong means operating without a required officer.

When You Need a Data Protection Impact Assessment

Processing sensitive data on a large scale triggers a mandatory Data Protection Impact Assessment under Article 35. The same requirement applies to systematic large-scale monitoring of publicly accessible areas. The assessment is a structured analysis the organization has to complete before processing begins.⁹

At minimum, the assessment has to contain four elements: a systematic description of the processing operations and purposes, including any legitimate interest being pursued; an analysis showing the processing is necessary and proportionate; an evaluation of the specific risks to individuals’ rights and freedoms; and the safeguards, security measures, and mechanisms the organization will use to protect the data and demonstrate compliance. These are drawn directly from Article 35(7).⁹ Typical safeguards include encryption, pseudonymization (replacing identifying details with coded values), access controls, and staff training. The assessment is a living document; when the nature of the processing changes, the assessment has to be updated.

If the assessment shows a high residual risk the organization cannot adequately reduce, Article 36 requires prior consultation with the national supervisory authority before processing begins. The authority can impose conditions, require changes, or prohibit the processing outright.¹⁰

Penalties for Getting It Wrong

Mishandling sensitive personal data exposes an organization to the GDPR’s highest tier of administrative fines. Article 83(5) explicitly lists violations of Article 9 among the infractions subject to penalties of up to €20 million or 4% of total worldwide annual turnover from the preceding financial year, whichever figure is higher.¹

These are not theoretical ceilings. Supervisory authorities across Europe have issued substantial fines for sensitive data violations. Beyond financial penalties, organizations face reputational damage and civil claims from affected individuals. Each EU member state can also add its own penalties, including criminal sanctions, through national law. Processing sensitive personal data without a documented legal basis, a completed impact assessment where required, and appropriate safeguards puts an organization in violation before any regulator arrives.

1
General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines
2
General Data Protection Regulation (GDPR). Art. 9 GDPR Processing of Special Categories of Personal Data
3
General Data Protection Regulation (GDPR). Art. 4 GDPR Definitions
4
Autoriteit Persoonsgegevens. Rules for the Use of Biometrics
5
European Data Protection Board. Guidelines 05/2020 on Consent Under Regulation 2016/679
6
General Data Protection Regulation (GDPR). Art. 10 GDPR Processing of Personal Data Relating to Criminal Convictions and Offences
7
General Data Protection Regulation (GDPR). Art. 22 GDPR Automated Individual Decision-Making, Including Profiling
8
General Data Protection Regulation (GDPR). Art. 37 GDPR Designation of the Data Protection Officer
9
General Data Protection Regulation (GDPR). Art. 35 GDPR Data Protection Impact Assessment
10
General Data Protection Regulation (GDPR). Art. 36 GDPR Prior Consultation