Category: Special Category Data
Conditions Lifting the Prohibition
Simply put
This term is used in data protection to describe the specific circumstances that must be met before an organisation may process particularly sensitive personal data, which is otherwise prohibited by default. In other words, sensitive data cannot normally be used unless one of these defined exceptions applies.
Formal definition
In the context of the GDPR, "conditions lifting the prohibition" generally refers to the exhaustive list of exceptions that permit the processing of special category (sensitive) personal data, which is otherwise prohibited as a starting position under Article 9. These conditions are typically understood to be enumerated in Article 9(2) (for example explicit consent, employment/social security obligations, vital interests, or substantial public interest), and satisfying one of them is in addition to identifying a lawful basis under Article 6. The precise availability and scope of individual conditions can be varied by EU or UK member state derogations and national implementing law, so the applicable condition should be confirmed against the current official text and relevant guidance for the specific processing.
Why it matters
Special category data covers information that is treated as particularly sensitive under data protection law, and the default position is that processing it is prohibited. The conditions that lift this prohibition therefore act as the gateway to any lawful handling of such data. If an organisation cannot identify and satisfy one of these conditions, its processing of sensitive personal data will generally be unlawful, regardless of how sound its other governance may be. This makes the analysis a foundational compliance step rather than an optional refinement.
A recurring pitfall is treating the identification of a condition under this heading as sufficient on its own. As the technical definition indicates, satisfying a condition that lifts the prohibition is understood to be an additional requirement layered on top of, and not a substitute for, the separate need to identify a general lawful basis. Organisations that document only one of these two elements may believe they are compliant when they are not. Compliance here is context and risk dependent, and the correct condition depends closely on the specific processing activity and its purpose.
Because the availability and precise scope of individual conditions can be varied by EU or UK member state derogations and national implementing law, the position is not uniform across jurisdictions. A condition that is available for a given activity in one member state may be framed differently, or subject to additional safeguards, elsewhere. Organisations operating across borders should therefore confirm the applicable condition against the current official text and relevant guidance for each processing operation rather than assuming a single settled answer.
Who it's relevant to
Data Protection Officers and compliance leads
DPOs and compliance teams typically need to confirm, and document, which condition lifts the prohibition for each activity involving special category data. Because this is generally an additional requirement on top of a general lawful basis, they should ensure both elements are recorded and should verify the applicable condition against the current official text and relevant guidance.
Privacy and data protection lawyers
Legal advisers assess whether an organisation can rely on a particular condition and how member state derogations or national implementing law may vary its availability or scope. Given that the precise article references and the divergence between jurisdictions should be confirmed rather than assumed, this analysis is context specific and may differ between EU and UK GDPR positions.
Engineers and product teams handling sensitive data
Teams building systems that process sensitive personal data need to understand that such processing is prohibited by default and permitted only where a defined condition applies. They should generally involve privacy specialists early, since identifying an applicable condition, alongside a separate lawful basis, is a prerequisite rather than a later formality.
Inside Conditions Lifting the Prohibition
General prohibition under Article 9(1)
Article 9(1) GDPR sets out a baseline prohibition on the processing of special category (sensitive) personal data, which includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person's sex life or sexual orientation. The 'conditions lifting the prohibition' are the exhaustive exceptions in Article 9(2) that may permit such processing.
Explicit consent (Article 9(2)(a))
Processing may be permitted where the data subject has given explicit consent to the processing for one or more specified purposes. This is a higher standard than the ordinary consent used as an Article 6 legal basis, and member state law may in some cases provide that the prohibition cannot be lifted by consent. Note that an Article 9 condition must generally be paired with an Article 6 legal basis.
Employment, social security and social protection law (Article 9(2)(b))
Processing may be permitted where necessary for carrying out obligations and exercising rights in the field of employment, social security and social protection law, insofar as authorised by Union or member state law or a collective agreement providing appropriate safeguards. The precise scope depends heavily on national implementing law and can vary between member states.
Vital interests where consent cannot be given (Article 9(2)(c))
Processing may be permitted where necessary to protect the vital interests of the data subject or another person where the data subject is physically or legally incapable of giving consent. This is typically read narrowly, generally applying to life-threatening or similar situations.
Not-for-profit body activities (Article 9(2)(d))
Processing may be permitted in the course of legitimate activities, with appropriate safeguards, by a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, and on condition that the processing relates solely to members or former members or persons in regular contact, and that the data are not disclosed outside that body without consent.
Data manifestly made public (Article 9(2)(e))
Processing may be permitted where it relates to personal data which are manifestly made public by the data subject. Regulators and guidance generally interpret 'manifestly' strictly, requiring a clear affirmative act by the data subject; incidental or inadvertent disclosure typically does not satisfy this condition.
Legal claims and courts (Article 9(2)(f))
Processing may be permitted where necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
Substantial public interest (Article 9(2)(g))
Processing may be permitted where necessary for reasons of substantial public interest, on the basis of Union or member state law which must be proportionate, respect the essence of the right to data protection, and provide suitable and specific safeguards. The available grounds depend substantially on national implementing legislation.
Health and social care (Article 9(2)(h))
Processing may be permitted where necessary for preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems, subject to the conditions and safeguards in Article 9(3), including a professional obligation of secrecy.
Public health (Article 9(2)(i))
Processing may be permitted where necessary for reasons of public interest in the area of public health, on the basis of Union or member state law providing suitable and specific safeguards.
Archiving, research and statistics (Article 9(2)(j))
Processing may be permitted where necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in accordance with Article 89(1) and based on Union or member state law that is proportionate and provides appropriate safeguards.
Article 9(3) additional safeguards
The health-related condition in Article 9(2)(h) is subject to Article 9(3), which requires that the data be processed by or under the responsibility of a professional subject to an obligation of professional secrecy, or by another person also subject to such an obligation under Union or member state law.
Relationship to Article 6 legal basis
An Article 9(2) condition lifts the specific prohibition on sensitive data but does not, on its own, make the processing lawful. In most cases a separate Article 6 legal basis is also required, and the two must be identified independently.
Common questions
Answers to the questions practitioners most commonly ask about Conditions Lifting the Prohibition.
Does lifting the Article 9(1) prohibition mean I no longer need a legal basis under Article 6?
No. The conditions in Article 9(2) that lift the general prohibition on processing special category data operate in addition to, not instead of, an Article 6 legal basis. In most cases you must identify both a valid Article 6 basis (such as consent, contract, legal obligation, vital interests, public task, or legitimate interests) and a separate Article 9(2) condition. Satisfying one does not satisfy the other, and the two are assessed independently.
Is explicit consent always required to process special category data?
No. Explicit consent is only one of the conditions listed in Article 9(2); it is not a universal requirement. Other conditions may apply depending on context, for example those relating to employment and social security obligations, vital interests, legitimate activities of certain not-for-profit bodies, data manifestly made public by the data subject, legal claims, substantial public interest, health or social care, public health, and archiving, research or statistics. Which condition is available depends on the purpose and the surrounding circumstances, and several of these conditions are subject to further requirements or member state law.
How do I determine which Article 9(2) condition applies to a given processing activity?
Generally you should start from the specific purpose of the processing and then assess which listed condition, if any, genuinely fits that purpose, rather than selecting a condition to justify a predetermined activity. Because several conditions require additional safeguards or depend on national implementing law, you should document your reasoning, confirm any supplementary requirements, and verify the position against the current official text and applicable member state provisions, which can vary.
What should I record to demonstrate that a condition lifting the prohibition applies?
As a matter of accountability, it is generally advisable to document the identified Article 6 legal basis, the specific Article 9(2) condition relied upon, and any additional requirements attached to that condition. Where national law imposes further conditions or safeguards, those should be recorded as well. The precise documentation expected can differ between regulators, so you should confirm supervisory authority guidance relevant to your jurisdiction.
Do national or member state rules affect which conditions are available?
Yes, in many cases. Several Article 9(2) conditions expressly depend on, or may be further specified by, member state or (for the UK GDPR) national implementing law, and some conditions require additional safeguards set out in that law. As a result the practical availability and requirements of a given condition can vary by jurisdiction, and you should check the applicable national implementing legislation rather than relying on the Regulation text alone.
If a condition ceases to apply, can processing continue?
Generally, no. The lawful basis for processing special category data is tied to the continuing applicability of both the Article 6 basis and the relevant Article 9(2) condition. If the condition no longer applies, you should reassess whether another condition is available for the same purpose; if none is, continued processing of that special category data will typically not be lawful. This is a context-dependent assessment that should be reviewed against current guidance.
Common misconceptions
Consent is always required to process special category data.
Explicit consent is only one of the exhaustive conditions in Article 9(2). Several other conditions, such as employment law obligations, vital interests, substantial public interest, health and social care, or research, can lift the prohibition without consent. Which conditions are available often depends on Union or member state implementing law, so the position can vary between jurisdictions.
Satisfying an Article 9(2) condition alone makes the processing lawful.
An Article 9(2) condition removes the specific prohibition on sensitive data, but a separate Article 6 legal basis is generally still required. The two are distinct assessments and both should typically be documented.
If a data subject has posted sensitive information online, it can be freely processed under the 'manifestly made public' condition.
Article 9(2)(e) is generally interpreted strictly and requires a clear, deliberate act by the data subject to make the data public. Incidental exposure, third-party disclosure, or ambiguous circumstances typically do not meet this threshold, and the condition should be relied on cautiously and subject to assessment.
Best practices
Identify and document a specific Article 9(2) condition alongside a separate Article 6 legal basis before processing special category data, treating them as distinct requirements.
Check the relevant national implementing law, as several Article 9(2) conditions (for example (b), (g), (h), (i) and (j)) depend on Union or member state law and safeguards that can vary between jurisdictions.
Where relying on explicit consent under Article 9(2)(a), apply a higher evidentiary standard than ordinary consent and confirm that member state law does not restrict consent as a route for the processing in question.
Interpret narrowly-construed conditions, such as vital interests (9(2)(c)) and 'manifestly made public' (9(2)(e)), conservatively, and record the reasoning supporting reliance on them.
For health and social care processing under Article 9(2)(h), ensure the Article 9(3) professional secrecy safeguards are in place and evidenced.
Reassess reliance periodically and verify each cited article, condition, and any applicable national derogation against the current official GDPR text and up-to-date regulatory guidance, since interpretation and implementing law can evolve.