Category: Special Category Data

Data Concerning Sex Life or Sexual Orientation

Also known as: Sex life data, Sexual orientation data

Simply put

This is personal information about a person's sexual attractions and their sexual activity or relationships. Under EU data protection law it is treated as especially sensitive, so it gets extra legal protection beyond ordinary personal data. Sexual orientation refers to a person's enduring emotional, romantic or sexual attraction to others.

Formal definition

A sub-type of special category personal data comprising information about a data subject's sex life and information about their sexual orientation, the latter understood as an enduring pattern of emotional, romantic and/or sexual attraction to others. As special category data, its processing is generally prohibited unless one of the additional conditions applicable to such data is satisfied, in addition to an ordinary lawful basis. Available guidance indicates that this category, as framed in law, does not explicitly encompass gender identity; practitioners should verify scope against the current official text and applicable regulatory guidance, as national implementations and derogations may vary and the treatment of related concepts such as gender identity or trans identity/history may differ.

Why it matters

Data concerning a person's sex life or sexual orientation is treated as special category data under EU data protection law, meaning its processing is generally prohibited unless an additional condition is satisfied alongside an ordinary lawful basis. This heightened protection reflects the potential for serious harm, including discrimination, stigma, exclusion, or personal safety risks, where such information is disclosed or misused. For individuals who are LGBTQI, the sensitivity is particularly acute, and mishandling this data can expose people to prejudice or, in some contexts, danger.

Because this category is defined by law rather than by the categories organisations may use in practice, its scope requires careful attention. Available guidance indicates that the special category, as framed in law, covers sexual orientation and sex life but does not explicitly refer to gender identity. Related concepts such as gender identity or trans identity and history may be treated differently, and their status should be verified against the current official text and applicable regulatory guidance. National implementations and derogations may vary, so practitioners should not assume a uniform position across member states.

For controllers and processors, the practical consequence is that any collection of information about attraction, relationships, or sexual activity triggers the more demanding compliance regime for special category data. This affects survey design, HR and diversity monitoring, health services, and any system that records or infers such information. Given the potential for harm, organisations should approach this data with particular caution and confirm both the legal basis and the additional condition before processing.

Who it's relevant to

Data Protection Officers and Compliance Leads

DPOs and compliance teams must identify where sex life or sexual orientation data is processed and confirm that both an ordinary lawful basis and an applicable additional condition for special category data are in place. They should also assess scope carefully, since gender identity and trans identity or history are not explicitly covered by this category and may require separate analysis under national law.

HR and Diversity Monitoring Teams

Teams that collect diversity or equality data, including information about sexual orientation, are handling special category data and should design collection processes accordingly. This typically includes confirming the appropriate condition for processing, limiting collection to what is necessary, and considering the risks of discrimination or harm to individuals if the data is disclosed.

Health and Public Sector Services

Health services and public bodies that record information about sexuality, sexual orientation, or sexual activity, for example in clinical or service datasets, process especially sensitive data. Given member state derogations and sector-specific rules, these organisations should verify the applicable conditions and any national requirements against current official guidance.

Product and Engineering Teams

Engineers building systems that collect, infer, or store information about attraction, relationships, or sexual activity should treat such data as special category data with heightened safeguards. Because inference can bring data within scope even without direct collection, teams should assess data flows carefully and coordinate with compliance on the appropriate basis and condition.

Inside Data Concerning Sex Life or Sexual Orientation

Special category status

Data concerning a person's sex life or sexual orientation is treated as a special category of personal data under Article 9 GDPR, meaning it attracts enhanced protection beyond the ordinary Article 6 legal basis analysis.

Sexual orientation

Information revealing whether a person is, for example, heterosexual, homosexual, bisexual, or otherwise, including data from which such orientation can reasonably be inferred rather than only data that states it explicitly.

Sex life

Information relating to an individual's sexual activity, practices, or intimate relationships. The boundary of what counts as 'sex life' data can be fact-specific and is subject to assessment in context.

Additional Article 9 condition required

Processing this data generally requires both a lawful basis under Article 6 and a separate condition under Article 9(2), such as explicit consent or another applicable exception; the availability of some conditions can be affected by member state law.

Inference and indirect revelation

Data may fall within this category where it is capable of revealing sex life or sexual orientation through inference, so the scope is not limited to fields expressly labelled as such. The precise treatment of inferred special category data continues to attract regulatory and judicial attention.

Common questions

Answers to the questions practitioners most commonly ask about Data Concerning Sex Life or Sexual Orientation.

Is data concerning sex life or sexual orientation prohibited from being processed altogether?

No. This category is treated as special category data under Article 9, which sets a general prohibition on processing, but that prohibition is subject to the exceptions listed in Article 9(2). Processing can therefore be lawful where one of those conditions applies, for example explicit consent or another applicable condition, in addition to a valid Article 6 legal basis. The correct framing is that such data is subject to heightened protection and additional conditions, not that it is categorically banned.

Does an ordinary Article 6 legal basis on its own justify processing this type of data?

No. Special category data generally requires two layers: a lawful basis under Article 6 and, in addition, a separate condition under Article 9(2). Consent used to satisfy Article 9 must typically be explicit, which is a higher standard than the consent that may suffice under Article 6 in some contexts. Relying on an Article 6 basis alone would not be sufficient for data concerning sex life or sexual orientation.

How do we determine whether a data set actually falls into this special category?

Assess whether the data reveals or relates to an individual's sex life or sexual orientation, either directly or by inference. Information that on its face appears neutral can fall within scope where, in context, it allows such characteristics to be inferred. Because inference-based classification can be uncertain and interpretations may vary between regulators, this determination should be documented and treated as a fact-specific assessment rather than a fixed rule.

Which Article 9(2) condition should we rely on when processing this data?

The appropriate condition depends on the context and purpose of processing. Explicit consent is one commonly considered route, but other Article 9(2) conditions may apply depending on the circumstances. Member state law and derogations can affect which conditions are available and how they operate, so the choice should be identified before processing begins and verified against the current official text and any applicable national implementing law.

What documentation and safeguards should accompany processing of this data?

Organisations should typically record both the Article 6 basis and the Article 9(2) condition relied upon, and maintain appropriate technical and organisational measures reflecting the sensitivity of the data. Given the heightened risk profile, a Data Protection Impact Assessment under Article 35 may be required or advisable, subject to assessment of the specific processing. The precise expectations can be shaped by regulator guidance, which should be consulted.

How should we handle this data when it is inferred rather than explicitly provided by the individual?

Where processing produces or relies on inferences about sex life or sexional orientation, the resulting data can still fall within the special category and attract the associated protections. In such cases the same requirement for both a lawful basis and an Article 9(2) condition generally applies. Because the treatment of inferred data can involve recognised uncertainty and evolving guidance, this is an area where the boundary of the definition should be assessed carefully and monitored.

Common misconceptions

Explicit consent is the only way to process data concerning sex life or sexual orientation.

Explicit consent is one condition under Article 9(2), but other conditions may apply depending on the circumstances, and some conditions are subject to member state derogations. Consent is not a universal requirement, though a valid Article 6 basis is still needed alongside the Article 9 condition.

Only data that expressly states someone's orientation or sex life is covered.

Data from which sexual orientation or sex life can reasonably be inferred can also fall within this special category, subject to assessment. The exact treatment of inferred data remains an area of evolving guidance and case law.

This category protects the same subjects and scope everywhere the GDPR-style rules apply.

The core concept is common to the EU GDPR and UK GDPR, but national implementing laws and member state derogations can vary the available Article 9 conditions and related safeguards, so the position should be checked against the applicable jurisdiction's current rules.

Best practices

Confirm both a lawful basis under Article 6 and a specific Article 9(2) condition before processing, and document each separately rather than relying on a single justification.

Assess whether data could reveal sex life or sexual orientation by inference, not only by explicit labelling, and treat such data as special category where that risk exists.

Where you rely on explicit consent, ensure it meets the heightened standard and record how it was obtained; where you rely on another condition, verify it is available in the relevant jurisdiction given possible member state derogations.

Check the applicable national implementing law (for example under the UK GDPR or an EU member state) because available conditions and safeguards can vary.

Apply data minimisation and access controls appropriate to the sensitivity, and consider whether a Data Protection Impact Assessment under Article 35 is warranted for high-risk processing of this data.

Verify your analysis against the current official Regulation text and up-to-date regulatory guidance, as treatment of inferred special category data continues to evolve.