Skip to main content
Privacy Track
Category: Special Category Data

Data Concerning a Person's Sex Life

Also known as: Sex Life Data, Sex Life Information
Simply put

This is personal information about an individual's sex life, meaning aspects of their sexual behaviour or activity. It is treated as a particularly sensitive type of personal data that generally requires stronger protection than ordinary personal data. According to ICO guidance, it refers to data about a person's sex life that does not specifically relate to their sexual orientation or their health, which are treated as distinct categories.

Formal definition

Data concerning a natural person's sex life is a form of special category data under the GDPR (listed within Article 9), attracting the additional protections applicable to sensitive personal data and requiring an Article 9 condition in addition to an Article 6 lawful basis. In practice, it is distinguished from the separate special category of data concerning sexual orientation and from health data, although the boundaries can overlap and require case-by-case assessment. ICO guidance frames it as any data on a person's sex life that does not specifically relate to orientation or health; the precise scope is context-dependent and readers should verify the current position against the official GDPR/UK GDPR text and regulator guidance, noting that national implementing law and member state derogations may affect the treatment of such data.

Why it matters

Data concerning a person's sex life is classified as special category data under Article 9 of the GDPR, meaning it attracts protections beyond those applied to ordinary personal data. Because this information can reveal intimate aspects of an individual's private life, its mishandling carries heightened risks of harm, including distress, discrimination, and reputational damage. Organisations that process such data must therefore identify not only an Article 6 lawful basis but also a separate Article 9 condition, and treat the data with a correspondingly higher standard of care.

The practical significance lies in the fact that this category is easy to trigger inadvertently. According to ICO guidance, sex life data covers information about a person's sexual behaviour or activity that does not specifically relate to their sexual orientation or their health, both of which are treated as distinct categories. Because the boundaries between these categories can overlap, organisations may hold sex life data without having consciously set out to collect it, for example through service usage records or account sign-ups that reveal aspects of an individual's sex life. Misclassifying such data risks applying the wrong safeguards and failing to meet the additional Article 9 requirements.

The precise scope of this category is context-dependent, and national implementing law and member state derogations may affect how such data is treated. Organisations should verify the current position against the official GDPR and UK GDPR text and current regulator guidance rather than relying on a fixed interpretation, particularly where a dataset sits close to the boundary with sexual orientation or health data.

Who it's relevant to

Data Protection Officers and Compliance Leads
DPOs and compliance teams need to identify when processing involves data concerning a person's sex life so that the additional Article 9 protections are applied on top of an Article 6 lawful basis. This includes assessing whether a dataset falls within the sex life category or overlaps with the distinct categories of sexual orientation or health data, and documenting the reasoning where the boundary is unclear.
Privacy and Technology Lawyers
Legal advisers assessing processing activities involving intimate personal data should distinguish sex life data from orientation and health data, since each is treated as a distinct special category and the classification affects the applicable conditions. They should also account for the fact that national implementing law and member state derogations may vary the treatment, and verify positions against the current GDPR and UK GDPR text and regulator guidance.
Engineers and Product Teams
Teams building services that could capture information about sexual behaviour or activity, including through account sign-ups or service usage, should recognise that such data may qualify as special category data even where it was not deliberately collected as such. Early identification supports appropriate safeguards, access controls, and lawful basis decisions before processing begins.
Organisations Operating Across Multiple Jurisdictions
Because the definition and treatment of sensitive data relating to sexuality can differ between legal regimes, and because member state derogations and national implementing law may affect the EU and UK position, organisations processing this data across borders should confirm the applicable rules in each relevant jurisdiction rather than assuming a single uniform standard.

Inside Data Concerning a Person's Sex Life

Special Category Status
Data concerning a person's sex life is enumerated among the special categories of personal data under Article 9 GDPR. Its processing is generally prohibited unless one of the specific Article 9(2) conditions applies, in addition to an Article 6 legal basis.
Relationship to Sexual Orientation
Article 9 lists both 'data concerning a natural person's sex life' and 'sexual orientation' as protected categories. Sex life data is typically understood to concern a person's sexual practices, activities, or history, while sexual orientation concerns the direction of a person's attraction. The two overlap but are conceptually distinct, and the precise boundary can be a matter of assessment.
Direct and Inferred Data
This category can include data that directly reveals aspects of a person's sex life as well as data from which such information may be inferred. Whether inferred data falls within the special category can depend on the context and the purpose of processing, and this is an area where regulatory guidance and case law continue to develop.
Additional Condition Requirement
Because this is special category data under Article 9, processing generally requires both a lawful basis under Article 6 and a separate Article 9(2) condition, such as explicit consent, subject to any applicable member state derogations that may vary the position.
Scope Limitations
The category applies to personal data of identifiable living individuals. It does not extend to genuinely anonymous data, and the position regarding deceased persons is generally outside the GDPR's scope, subject to national implementing law.

Common questions

Answers to the questions practitioners most commonly ask about Data Concerning a Person's Sex Life.

Is data concerning a person's sex life the same thing as data concerning sexual orientation?
No, these are distinct concepts, though both fall within the special categories of personal data under Article 9 GDPR. Data concerning a natural person's sex life relates to sexual activity, behaviour, or practices, whereas data concerning sexual orientation relates to a person's enduring pattern of attraction or identity (for example, being heterosexual, homosexual, or bisexual). Article 9 lists both, and each is protected, but they should not be treated as interchangeable. A single data point may in some cases implicate both, and the boundary between them can require case-by-case assessment. You should verify the exact wording of Article 9 against the current official text.
Does the fact that this data is 'special category' mean it is always prohibited to process it?
No. Article 9(1) sets a general prohibition on processing special category data, but Article 9(2) provides a set of conditions that can lift that prohibition, such as explicit consent or other listed grounds. Processing is therefore not absolutely forbidden; it is permitted where an Article 9(2) condition applies. Importantly, satisfying an Article 9(2) condition does not remove the separate requirement to identify an Article 6 lawful basis. In practice you generally need both a valid Article 6 basis and a valid Article 9(2) condition, and member state law may add further conditions or restrictions. You should confirm the available conditions against the current text and any relevant national implementing law.
What lawful basis and additional condition should we rely on to process data concerning sex life?
You typically need to identify an Article 6 lawful basis and, in addition, an Article 9(2) condition, because this is special category data. The appropriate combination depends on your context and purpose; for example, explicit consent may serve as an Article 9(2) condition in some scenarios, but consent is not a universal requirement and other conditions may be more suitable depending on the situation. Note that member state derogations can vary which conditions are available and on what terms. Each processing purpose should be assessed individually, and you should document your reasoning and verify the applicable conditions against the current official text.
When should we carry out a Data Protection Impact Assessment for processing that involves this data?
Processing special category data such as data concerning sex life, particularly on a large scale, is generally an indicator that a Data Protection Impact Assessment under Article 35 may be required, because such processing can present a high risk to the rights and freedoms of individuals. A DPIA is a separate instrument from a Data Processing Agreement under Article 28 and serves a different function: the DPIA assesses and mitigates risk, while the Article 28 agreement governs the controller-processor relationship. Whether a DPIA is strictly mandatory depends on the specifics of your processing and on supervisory authority guidance and lists, which can differ between member states. Where there is doubt, conducting a DPIA is generally the prudent course, and you should check your relevant supervisory authority's guidance.
How should we handle security and access controls for records that reveal a person's sex life?
Given the sensitivity of this category of data, controllers and processors should generally apply heightened technical and organisational measures proportionate to the risk, consistent with the security obligations in Article 32. In practice this typically includes strict access controls on a need-to-know basis, encryption or pseudonymisation where appropriate, logging and monitoring of access, and clear retention limits. The precise measures are risk- and context-dependent rather than fixed, so they should be determined through assessment. Note that pseudonymised data generally remains personal data, whereas genuinely anonymous data falls outside the scope of the GDPR; whether a given technique achieves anonymisation should be assessed carefully.
How do we manage cross-border transfers of data concerning sex life outside the EU?
Transfers of this data to a third country generally require a valid transfer mechanism in the same way as other personal data, for example reliance on an adequacy decision, or a transfer tool such as Standard Contractual Clauses or, where applicable within a corporate group, Binding Corporate Rules. These instruments are distinct: Standard Contractual Clauses are contractual terms for a specific transfer relationship, whereas Binding Corporate Rules are approved internal rules for intra-group transfers. Because the data is especially sensitive, you should also consider whether supplementary measures are needed following a transfer risk assessment. Adequacy decisions, transfer tools, and expectations around supplementary measures evolve over time, so you should verify the current status of any mechanism before relying on it.

Common misconceptions

Data about a person's sex life is the same thing as data about their sexual orientation.
Article 9 references these as related but distinct concepts. Sex life data typically concerns sexual activities or history, whereas sexual orientation concerns the direction of attraction. Both are special category data, but conflating them can lead to imprecise mapping of what is being processed.
Explicit consent is the only way to lawfully process this data.
Explicit consent is one of the Article 9(2) conditions, but it is not the only one. Other conditions may apply depending on the context, and member state law may provide additional or varied conditions. Consent should not be assumed to be a universal requirement or the only available route.
An Article 6 legal basis alone is sufficient to process this data.
Because this is special category data, an Article 6 basis is generally necessary but not sufficient on its own. A separate Article 9(2) condition is typically also required for lawful processing.

Best practices

Identify and document both the Article 6 legal basis and the applicable Article 9(2) condition before processing any data concerning a person's sex life.
Assess carefully whether the data you hold directly reveals or allows inference of sex life information, since inferred data may fall within the special category depending on context.
Distinguish clearly in your records of processing between sex life data and sexual orientation data, as they are related but distinct special categories.
Check applicable member state or UK implementing law, as national derogations can vary the available conditions and safeguards for this category.
Consider whether a Data Protection Impact Assessment under Article 35 is warranted, given the sensitivity and elevated risk typically associated with this category.
Monitor evolving regulatory guidance and case law on the boundaries of this category, and verify specific conditions against the current official text rather than relying on a fixed snapshot.