Category: Special Category Data

Article 9

Also known as: GDPR Article 9, Article 9 GDPR, Special Category Data (Article 9)

Simply put

In data protection, Article 9 of the GDPR sets special rules for handling particularly sensitive personal information, such as data about health, race or ethnicity, religious beliefs, political opinions, trade union membership, sex life or sexual orientation, and genetic and biometric data used to identify someone. As a general rule, processing this 'special category' data is prohibited unless one of a limited set of specific conditions applies. This means having an ordinary lawful basis is typically not enough on its own; an additional Article 9 condition is generally required.

Formal definition

Article 9 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) establishes a default prohibition, in Article 9(1), on processing 'special categories' of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, together with genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person's sex life or sexual orientation. Article 9(2) then sets out an exhaustive list of conditions that lift the prohibition, which generally include (among others) explicit consent; obligations and rights in the field of employment, social security and social protection law; protection of vital interests where the data subject is incapable of consent; processing by certain not-for-profit bodies; data manifestly made public by the data subject; establishment, exercise or defence of legal claims; substantial public interest; preventive or occupational medicine, medical diagnosis and the provision of health or social care; public health; and archiving in the public interest, scientific or historical research purposes, or statistical purposes under Article 89(1), practitioners should verify the precise sub-paragraph wording and lettering against the current official text. An Article 9 condition operates in addition to, and does not replace, the requirement for an Article 6 lawful basis. Article 9(3) provides a professional-secrecy safeguard for processing under certain health-related conditions where data are processed by or under the responsibility of a professional subject to an obligation of secrecy, and Article 9(4) preserves the ability of member states to maintain or introduce further conditions, including limitations, with regard to genetic data, biometric data or data concerning health, meaning national implementing law can vary the position. Scope is limited to personal data of identifiable living individuals; it does not cover anonymous data. Note that a corresponding provision exists in the UK GDPR, but UK-specific conditions and safeguards are set out in national law (such as the UK Data Protection Act), so the EU and UK regimes should not be assumed to be identical and each should be checked against its own current text.

Why it matters

Article 9 marks out the categories of personal data that carry the greatest potential to harm, discriminate against, or expose individuals, and it responds by imposing a default prohibition on their processing rather than merely regulating it. For any organisation handling information about health, race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, or genetic and biometric identifiers, this changes the compliance starting point: the activity is presumptively unlawful unless a specific Article 9(2) condition can be identified and documented. Misjudging this can invalidate an entire processing operation, because an Article 6 lawful basis alone does not lift the Article 9(1) prohibition.

The practical stakes are heightened by how easily ordinary data can become special category data through inference or context. Fitness metrics, dietary preferences, images that reveal ethnicity or religious dress, or profiling that reveals health conditions can bring processing within Article 9 even where that was not the original intent. Because the list of exemptions in Article 9(2) is exhaustive, organisations cannot rely on general fairness or convenience arguments; they must map each processing purpose to a defined condition and, where health-related conditions apply, respect the professional-secrecy safeguard in Article 9(3).

Article 9(4) further preserves the power of member states to maintain or introduce additional conditions and limitations for genetic data, biometric data and data concerning health, so the position can vary between jurisdictions. Organisations operating across the EU, or under the UK GDPR, should not assume a single uniform rule applies. The reader should verify the precise conditions, sub-paragraph wording and any national derogations against the current official text of the relevant Regulation and implementing law.

Who it's relevant to

Data Protection Officers and Compliance Leads

DPOs and compliance teams need to identify when processing falls within Article 9 and ensure that both an Article 6 lawful basis and a specific Article 9(2) condition are documented for each purpose. Because the Article 9(2) list is exhaustive, they should avoid assuming a general condition applies and should record which condition is relied on, along with any applicable safeguards under Article 9(3).

Privacy and Data Protection Lawyers

Lawyers advising on special category processing must distinguish the Article 9(2) condition from the separate Article 6 basis, verify precise sub-paragraph wording against the current official text, and account for Article 9(4) member-state derogations. They should also flag where EU GDPR and UK GDPR diverge, since UK-specific conditions and safeguards are set out in national law such as the UK Data Protection Act.

Healthcare and Life Sciences Organisations

Entities processing health, genetic or biometric data commonly rely on conditions relating to preventive or occupational medicine, provision of health or social care, public health, or scientific research and statistical purposes under Article 89(1). They must also observe the professional-secrecy safeguard in Article 9(3) where health data are processed by, or under the responsibility of, a professional subject to a secrecy obligation.

Engineers and Product Teams

Technical teams should recognise that special category data can arise through inference, profiling, or biometric processing used to uniquely identify a person, even where sensitive attributes are not collected directly. Building in the ability to document a condition, apply appropriate safeguards, and account for national variations under Article 9(4) helps keep processing within lawful boundaries.

Inside Article 9

Special categories of personal data

Article 9(1) defines a set of personal data categories treated as more sensitive: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person's sex life or sexual orientation. The processing of these categories is generally prohibited unless one of the exceptions in Article 9(2) applies.

General prohibition and its structure

Article 9(1) sets a default prohibition on processing special category data, which is then lifted where a condition in Article 9(2) is met. Because Article 9 concerns lawfulness of processing sensitive data specifically, meeting an Article 9(2) condition does not remove the separate need for an Article 6 legal basis; in most cases both are required.

Explicit consent (Art 9(2)(a))

Processing may be permitted where the data subject has given explicit consent for one or more specified purposes, subject to any Union or member state law that prohibits reliance on consent for certain processing. Explicit consent is generally understood to require a clearer, more affirmative expression than ordinary consent; verify the precise wording against the current official text.

Employment, social security and social protection (Art 9(2)(b))

Processing may be permitted where necessary for carrying out obligations and exercising specific rights in the field of employment, social security and social protection law, so far as authorised by Union or member state law or a collective agreement providing appropriate safeguards. The available scope can therefore vary between member states.

Vital interests (Art 9(2)(c))

Processing may be permitted where necessary to protect the vital interests of the data subject or another person where the data subject is physically or legally incapable of giving consent.

Not-for-profit bodies (Art 9(2)(d))

Processing may be permitted in the course of the legitimate activities, with appropriate safeguards, of a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, relating to its members, former members, or persons in regular contact, and provided the data is not disclosed outside the body without consent.

Data made public by the data subject (Art 9(2)(e))

Processing may be permitted where it relates to personal data manifestly made public by the data subject. The threshold for what is 'manifestly' made public is subject to assessment and interpretation.

Legal claims and courts (Art 9(2)(f))

Processing may be permitted where necessary for the establishment, exercise or defence of legal claims, or where courts are acting in their judicial capacity.

Substantial public interest (Art 9(2)(g))

Processing may be permitted where necessary for reasons of substantial public interest, on the basis of Union or member state law that is proportionate, respects the essence of the right to data protection, and provides suitable and specific safeguards. The precise scope depends heavily on national implementing law.

Health and social care (Art 9(2)(h)) and public health (Art 9(2)(i))

Processing may be permitted for purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or management of health or social care systems (Art 9(2)(h)), and for reasons of public interest in the area of public health (Art 9(2)(i)), in each case on the basis of Union or member state law with appropriate safeguards.

Archiving, research and statistics (Art 9(2)(j))

Processing may be permitted where necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, based on Union or member state law that is proportionate, respects the essence of the right, and provides suitable and specific safeguards, read together with the safeguards in Article 89(1).

Professional secrecy safeguard (Art 9(3))

The health-related conditions (notably Art 9(2)(h)) apply where the data is processed by, or under the responsibility of, a professional subject to an obligation of professional secrecy under Union or member state law or rules established by national competent bodies, or by another person also subject to such an obligation of secrecy.

Member state power to add conditions (Art 9(4))

Article 9(4) allows member states to maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health. This means the position for these three categories can diverge between member states, and practitioners should check the relevant national law.

UK GDPR position

The UK GDPR contains a corresponding Article 9 structure, but the conditions requiring Union or member state law are read with UK domestic law, principally the Data Protection Act 2018 (including its Schedule 1 conditions for special category and related processing). Obligations that depend on national law should therefore be assessed under UK legislation for UK processing and under the relevant member state law for EU processing; verify against the current official texts.

Common questions

Answers to the questions practitioners most commonly ask about Article 9.

Does processing special category data always require explicit consent?

No. Explicit consent is only one of the conditions in Article 9(2). Processing special category data is generally prohibited under Article 9(1) unless one of the exceptions in Article 9(2) applies. These include, among others, explicit consent, obligations in the field of employment and social security law, protection of vital interests where the data subject is incapable of consent, processing by not-for-profit bodies, data manifestly made public by the data subject, legal claims, substantial public interest, health or social care, public health, and archiving in the public interest or scientific, historical research or statistical purposes. In most cases you should identify the most appropriate Article 9(2) condition rather than defaulting to consent, and remember that an Article 6 legal basis is still required alongside the Article 9 condition.

Is a person's name or general contact information a special category of data?

Generally no. Special categories under Article 9(1) are limited to data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and to genetic data, biometric data processed for the purpose of uniquely identifying a person, health data, and data concerning a person's sex life or sexual orientation. Ordinary identifiers such as a name or email address are personal data but not special category data. Note that context can matter: data that indirectly reveals a special category (for example, a dietary requirement that may indicate a religious belief) may fall within scope subject to assessment, and this is an area where regulator interpretation can vary.

If I rely on explicit consent under Article 9(2)(a), what does 'explicit' add compared with ordinary consent?

Explicit consent must meet the general consent standard (freely given, specific, informed and unambiguous) and, in addition, be expressed through a clear affirmative statement rather than inferred from conduct alone. Regulatory guidance typically indicates that this means an express confirmation, for example a signed statement or an equivalent clearly worded electronic affirmation. Because 'explicit' is not exhaustively defined in the Regulation text, you should consult current guidance from the relevant supervisory authority and document how your mechanism satisfies the standard.

Do I need anything beyond an Article 9(2) condition to process special category data lawfully?

In most cases, yes. You typically need both an Article 6 lawful basis and a separate Article 9(2) condition, and these can be different (for example, legitimate interests under Article 6 alongside substantial public interest under Article 9). In addition, Article 9(3) requires that where processing relies on certain health-related grounds the data be processed by or under the responsibility of a professional subject to an obligation of professional secrecy, or by another person also subject to such an obligation. You should confirm which condition applies and whether the professional-secrecy safeguard is engaged.

Can national law impose extra requirements on genetic, biometric, or health data?

Yes. Under Article 9(4), member states may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data, and health data. This means the position can diverge between member states, and you should check the applicable national implementing law in each relevant jurisdiction rather than relying on the Regulation text alone.

How do EU GDPR and UK GDPR treat special category data differently?

Both the EU GDPR and the UK GDPR contain an equivalent Article 9 structure, and the core categories are the same. The key practical difference tends to lie in the national implementing framework: in the UK, several Article 9(2) conditions, particularly those requiring authorisation under member state or domestic law, such as substantial public interest, are operationalised through the Data Protection Act 2018 and its schedules, which set out specific conditions and additional safeguards. In EU member states the equivalent detail is found in each state's implementing law under Article 9(4) and related provisions. Because these regimes can diverge and are subject to change, verify the applicable conditions against the current UK legislation or the relevant member state law rather than assuming parity.

Common misconceptions

Meeting an Article 9(2) condition is all that is needed to process special category data lawfully.

Article 9(2) lifts the prohibition on processing sensitive data, but in most cases a separate Article 6 legal basis is still required for the same processing. The two operate together rather than one replacing the other.

Explicit consent is the only route to process special category data.

Explicit consent (Art 9(2)(a)) is one of several conditions. Others include employment and social protection law, vital interests, manifestly public data, legal claims, substantial public interest, health and social care, public health, and archiving, research and statistical purposes. The appropriate condition depends on the context and often on the applicable Union or national law.

The Article 9 rules are uniform across the EU and the UK.

Several Article 9(2) conditions depend on Union or member state law, and Article 9(4) expressly permits member states to impose further conditions for genetic, biometric and health data. The UK GDPR relies on UK domestic law such as the Data Protection Act 2018. The precise requirements can therefore vary by jurisdiction and should be verified against the current official texts.

Best practices

Confirm first whether the data actually falls within an Article 9(1) category, then identify the specific Article 9(2) condition relied on and document both, rather than assuming all sensitive processing requires consent.

Pair each Article 9(2) condition with a separate Article 6 legal basis and record the analysis, since in most cases both are needed.

For conditions that depend on Union or member state law (for example Art 9(2)(b), (g), (h), (i) and (j)), check the applicable national implementing law and required safeguards, and verify the position separately for EU and UK processing.

Where relying on health-related conditions, ensure the processing is carried out by or under the responsibility of a person subject to an obligation of professional secrecy as required by Article 9(3).

For genetic, biometric and health data, review whether the relevant member state has introduced further conditions or limitations under Article 9(4) before finalising the processing design.

When relying on Article 9(2)(j) for archiving, research or statistics, implement the suitable and specific safeguards contemplated by Article 89(1), and treat scope thresholds such as data 'manifestly made public' as matters requiring documented assessment.