GDPR Special Categories of Personal Data: Article 9 Rules and Exceptions

Under the GDPR, the special categories of personal data are eight specific types of sensitive information listed in Article 9(1): racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation. Processing any of these is prohibited by default, and an organization can only handle them if it satisfies one of ten exceptions in Article 9(2). Getting this wrong exposes the organization to the GDPR’s highest fine tier: up to €20 million or 4% of global annual turnover, whichever is higher.¹

The Eight Categories in Article 9(1)

The list is exhaustive. No other type of personal data qualifies as a special category, no matter how sensitive it feels.²

Racial or ethnic origin. The GDPR notes that using the term “racial origin” does not imply acceptance of theories about separate human races.
Political opinions, including party affiliation and voting preferences.
Religious or philosophical beliefs, including atheism, agnosticism, and other deeply held moral frameworks.
Trade union membership.
Genetic data.
Biometric data, but only when processed for the purpose of uniquely identifying a person.
Health data, including medical history, treatment records, disability status, and records of healthcare received.
Data concerning a person’s sex life or sexual orientation.

The technical definitions of three of these come from Article 4. Genetic data means personal data “relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person.” Biometric data means data “resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.” Health data means data “related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.”³

When a Photograph Becomes Biometric Data

A photograph of a person is not automatically special category data. It becomes biometric data only when it is run through specific technical processing to create a facial template used for automated matching. Simply storing a photo on a company server does not trigger Article 9.⁴ The same logic runs through the whole biometric category: a fingerprint used to unlock a personal device for authentication may fall outside Article 9, while a fingerprint database built to identify individuals across contexts clearly falls inside it.

Inferred Data Counts Too

You do not have to collect health records or ethnicity information directly to end up processing special category data. If a system infers ethnicity from browsing behavior, deduces a health condition from purchase patterns, or profiles sexual orientation from app usage, that is processing of special category data. According to ICO guidance, any profiling that infers ethnicity, beliefs, health status, or sexual orientation triggers Article 9 and requires a valid condition for processing.⁵ The intent to make the inference is what matters, not the label on the raw data you started with.

The Default Ban and What It Costs to Break It

Article 9(1) starts with a flat prohibition. Processing any of the eight categories is not allowed unless an exception applies. The burden falls on the organization to justify why it needs to handle the information at all.²

Breaching the prohibition, whether by processing without an exception or by failing to meet the requirements of the exception claimed, sits in the GDPR’s highest fine bracket: up to €20 million or 4% of total worldwide annual turnover from the preceding financial year, whichever is higher.¹

The Ten Exceptions in Article 9(2)

Overcoming the default ban requires meeting one of ten derogations. Each has its own conditions, and regulators read them narrowly. The organization must document which exception it relies on before processing begins.

Explicit Consent

The individual gives explicit consent to processing for one or more specified purposes. This is a higher bar than the “unambiguous” consent used for ordinary personal data: explicit consent must be affirmed in a clear statement, written or oral, and cannot be inferred from conduct. The statement should specifically reference the special category data involved, and should be separate from any other consents requested at the same time.⁶ EU or Member State law can also block this route for particular processing by providing that the individual cannot lift the prohibition by consent alone.²

Employment and Social Protection

Processing is permitted where necessary to carry out obligations or exercise rights in the field of employment, social security, and social protection law, as authorized by EU or Member State law or a collective agreement. In practice this covers occupational health assessments, statutory sick pay records, work eligibility checks, and payroll deduction of trade union subscriptions.⁷ Processing has to be genuinely necessary; purely contractual employment obligations do not qualify.

Vital Interests

Processing is allowed to protect someone’s life where the individual is physically or legally incapable of giving consent. The standard example is an unconscious patient arriving at a hospital and needing immediate access to health data for emergency treatment.²

Not-for-Profit Bodies

Foundations, associations, and other not-for-profit organizations with a political, philosophical, religious, or trade-union aim may process special category data about their members, former members, and people in regular contact, in the course of legitimate activities. The data cannot be disclosed outside the organization without the individual’s consent.² A church holding a membership register of congregants’ religious affiliation is a textbook use. Selling that list to a marketing firm is not.

Data Manifestly Made Public by the Individual

Where the individual has deliberately made their own special category data public, for example by posting about a diagnosis on a public social media profile, the prohibition does not apply to that already-public information.²

Legal Claims and Judicial Acts

Processing is permitted where necessary to establish, exercise, or defend legal claims, and whenever courts act in their judicial capacity. An employer gathering health data to respond to a disability discrimination claim would rely on this exception.²

Substantial Public Interest

EU or Member State law can authorize processing for reasons of substantial public interest. The authorizing law must be proportionate to the aim pursued and provide safeguards for individuals’ rights. Government-led equality monitoring and fraud prevention often sit here.²

Healthcare Purposes

Health data can be processed for preventive or occupational medicine, assessment of an employee’s working capacity, medical diagnosis, provision of health or social care and treatment, or management of health or social care systems, where authorized by EU or Member State law or a contract with a health professional. The data must be handled by professionals bound by an obligation of confidentiality.²

Public Health

Processing is allowed for public health reasons such as protection against serious cross-border health threats or ensuring quality and safety standards for medicines and medical devices. This requires a basis in EU or Member State law with specific safeguards, including respect for professional secrecy.²

Archiving, Research, and Statistics

The final derogation covers archiving in the public interest, scientific or historical research, and statistical purposes, subject to the Article 89(1) safeguards. Processing must be proportionate, respect the right to data protection, and include suitable protective measures.²

You Still Need an Article 6 Lawful Basis

An Article 9(2) derogation on its own is not enough. Every processing activity also needs one of the six lawful bases in Article 6: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The Article 6 and Article 9 grounds often overlap, but not always, and skipping the Article 6 analysis because an Article 9 derogation is in hand leaves a compliance gap.²

Extra Duties That Attach to Special Category Processing

Mandatory Impact Assessments

Processing special category data on a large scale requires a Data Protection Impact Assessment before the processing starts. Article 35(3)(b) is explicit on this.⁸ The DPIA must assess necessity and proportionality, evaluate risks to individuals, and identify mitigation measures. Even below the large-scale threshold, biometric identification systems, genetic testing programs, and any use of sensitive data to decide access to products, services, or opportunities are flagged by supervisory authorities as likely high risk and therefore DPIA-worthy.⁹

Records of Processing

Most organizations with fewer than 250 employees are exempt from keeping a Record of Processing Activities. That exemption disappears once special category data is involved. Article 30 strips the small-organization carve-out for any processing of Article 9 data, so even a small business collecting employee health information for occupational safety has to maintain a formal record covering purposes, categories of data subjects, categories of recipients, retention timelines, and a description of security measures.¹⁰

Data Protection Officer

An organization whose core activities involve large-scale processing of special category data must appoint a Data Protection Officer. Article 37(1) makes this mandatory.¹¹ The GDPR sets no numerical threshold for “large scale,” so the assessment turns on data volume, the number of individuals affected, the geographic scope, and the duration of the processing. The DPO must be involved early in data protection issues, advise on DPIAs, monitor compliance, and act as contact point for supervisory authorities and individuals.¹²

Security

Article 32 requires technical and organizational measures appropriate to the risk. For special category data the risk is inherently higher, which lifts the bar. The regulation names pseudonymization and encryption as relevant measures, alongside the ability to ensure ongoing confidentiality and integrity, restore availability after an incident, and regularly test the security posture.¹³

Automated Decision-Making

Article 22 already restricts decisions based solely on automated processing that produce legal or similarly significant effects. When special category data enters that pipeline the restriction tightens: such decisions can only be made with the individual’s explicit consent or where the processing is necessary for reasons of substantial public interest. No other Article 9(2) derogation supports it. Any special category data that enters an automated system accidentally should be deleted.¹⁴

Member State Overlays

Article 9(4) lets Member States maintain or introduce further conditions, including limitations, on the processing of genetic data, biometric data, or health data.² Germany, for example, has additional restrictions on employee health data in its Federal Data Protection Act. Organizations operating in more than one Member State need to check the national implementing legislation in each jurisdiction, not just the regulation itself.

What Is Not Special Category Data

Because the Article 9(1) list is closed, several types of information that feel sensitive fall outside it. Financial data such as bank account numbers, credit card details, and salary figures is not special category data. It still needs protection under the GDPR’s general security and lawfulness requirements, but it does not face the Article 9 prohibition.⁵ The same is true of home addresses, identification numbers, online identifiers, and location data.

Criminal conviction and offense data sits under Article 10, not Article 9. Processing must be carried out under the control of official authority or authorized by EU or Member State law, and any comprehensive register of criminal convictions can only be kept by an official authority.¹⁵ The practical effect resembles the special category regime, but the legal framework is separate, with its own conditions.

1
GDPR.eu. GDPR Article 83 – General Conditions for Imposing Administrative Fines
2
General Data Protection Regulation (GDPR). Article 9 GDPR – Processing of Special Categories of Personal Data
3
General Data Protection Regulation (GDPR). Art 4 GDPR – Definitions
4
General Data Protection Regulation (GDPR). Recital 51 EU General Data Protection Regulation
5
Information Commissioner’s Office. What Is Special Category Data?
6
Information Commissioner’s Office. What Is Valid Consent?
7
Information Commissioner’s Office. What Are the Conditions for Processing?
8
General Data Protection Regulation (GDPR). Art 35 GDPR – Data Protection Impact Assessment
9
Information Commissioner’s Office. Examples of Processing Likely to Result in High Risk
10
General Data Protection Regulation (GDPR). Art 30 GDPR – Records of Processing Activities
11
General Data Protection Regulation (GDPR). Designation of the Data Protection Officer
12
European Data Protection Board. Data Protection Officer
13
General Data Protection Regulation (GDPR). Article 32 GDPR – Security of Processing
14
Information Commissioner’s Office. Rights Related to Automated Decision Making Including Profiling
15
General Data Protection Regulation (GDPR). Article 10 GDPR – Processing of Personal Data Relating to Criminal Convictions and Offences