Skip to main content
Privacy Track
Category: Special Category Data

Data Revealing Racial or Ethnic Origin

Also known as: Racial or ethnic origin data, Race and ethnicity data
Simply put

This is personal information that shows a person's race or ethnic background, which the GDPR treats as sensitive and gives extra protection. Because it can be used to discriminate against people, organisations generally face stricter conditions before they can collect or use it. Standard personal data rules apply on top of these additional requirements.

Formal definition

Personal data revealing racial or ethnic origin is a category of sensitive (special category) personal data whose processing is subject to heightened protection under the GDPR, in addition to the general lawfulness requirements applicable to all personal data. Processing generally requires both a legal basis under Article 6 and a separate condition under Article 9, since special category data cannot be processed on an Article 6 basis alone. Note that member state law may introduce derogations or additional conditions affecting when such data may be processed, for example in contexts such as anti-discrimination or equality monitoring; the precise conditions and any national divergence should be verified against the current official text and applicable national implementing law. This entry addresses the EU GDPR position; the UK GDPR treats an equivalent category, but readers should confirm the specific national framework that applies.

Why it matters

Data revealing racial or ethnic origin sits within the GDPR's special category framework precisely because it carries a heightened risk of discrimination, exclusion, and other harms when misused. The GDPR treats this data as sensitive and generally imposes stricter conditions on its processing, requiring not only a lawful basis under Article 6 but also a separate condition under Article 9. For organisations, this means that collecting or using such data cannot be justified by an ordinary business rationale alone; the additional protective conditions must be satisfied, and the position may be further shaped by member state law.

The stakes are amplified by a genuine tension that the evidence highlights: the same data that can enable discrimination is also, in some contexts, necessary to detect and combat it. Academic and legal commentary examines how, and under what conditions, data on racial and ethnic origin may be lawfully collected to support anti-discrimination and equality objectives, and how those aims can be reconciled with individuals' privacy rights. This creates a nuanced compliance question rather than a blanket prohibition, and the applicable conditions can diverge between member states depending on national implementing law and any relevant derogations.

Because of this complexity, organisations should treat any processing of racial or ethnic origin data as high-risk by default and verify the specific conditions that apply in their jurisdiction. The precise Article 9 conditions available, and the extent to which national law permits processing for purposes such as equality monitoring, should be confirmed against the current official text and applicable national framework rather than assumed. This entry addresses the EU GDPR position; the UK GDPR treats an equivalent category, and readers operating across jurisdictions should confirm the specific rules that apply.

Who it's relevant to

Data Protection Officers and Compliance Leads
DPOs and compliance teams need to identify where racial or ethnic origin data is processed, including where it may be inferred rather than explicitly collected, and ensure that both an Article 6 legal basis and an appropriate Article 9 condition are documented. Given the recognised divergence between member states, they should verify the specific conditions and any national derogations that apply, rather than relying on a single interpretation as settled law.
Privacy and Data Protection Lawyers
Legal advisers assess whether a proposed processing activity, for example equality monitoring or anti-discrimination measures, can be reconciled with the heightened protections for this data. This typically involves examining the available Article 9 conditions, relevant national implementing law, and the boundary between lawful collection for equality purposes and disproportionate or unlawful processing, an area where guidance and case law continue to develop.
HR and Equality Monitoring Teams
Teams collecting workforce demographics, such as ethnicity data for diversity or equality reporting, are directly engaged because this data is generally special category data. Where such monitoring is undertaken, whether the data can be aggregated or anonymised sufficiently to fall outside these rules is a case-by-case assessment, and the permissibility of processing for equality purposes may depend on applicable national law.
Engineers and Data Teams
Those designing systems that store, infer, or analyse demographic attributes should flag racial or ethnic origin data for heightened controls, including access restrictions and careful assessment of whether model outputs or derived fields effectively reveal such origin. Technical decisions about anonymisation should be validated against legal assessment, since effective anonymisation is context-dependent and determines whether the special category rules continue to apply.

Inside Data Revealing Racial or Ethnic Origin

Special Category Data Classification
Data revealing racial or ethnic origin is treated as a special category of personal data under Article 9 of the GDPR, attracting heightened protection beyond ordinary personal data processed under Article 6.
Additional Article 9 Condition Requirement
Processing this data generally requires both a lawful basis under Article 6 and a separate condition for processing under Article 9(2). Identifying one does not satisfy the other; both must typically be established.
The 'Revealing' Threshold
The category captures not only explicit statements of racial or ethnic origin but, subject to assessment, data from which such origin may be inferred or deduced. The boundary of what 'reveals' origin can be fact-specific and is an area where regulatory guidance and case law continue to develop.
Scope Limitation to Individuals
As with all GDPR personal data, this category concerns identified or identifiable living individuals. Genuinely anonymous data generally falls outside scope, and the position on deceased persons is typically a matter for member state national law.
Jurisdictional Variation
The concept exists in materially similar form under the UK GDPR, but member state derogations and national implementing law can vary the available conditions and safeguards, so the position should be checked against the applicable jurisdiction.

Common questions

Answers to the questions practitioners most commonly ask about Data Revealing Racial or Ethnic Origin.

Does data revealing racial or ethnic origin only mean data that explicitly states someone's race?
No. The concept generally extends beyond explicit self-declared race or ethnicity to data from which such origin can be inferred or revealed, subject to assessment of the specific data and context. Depending on the circumstances, information such as certain images, names, or country of origin details could reveal racial or ethnic origin even where no express racial label is present. Whether a given data element falls within this special category is a fact-specific determination, and regulators and case law have addressed the point that inference can bring data into scope. You should verify the precise wording against the current official text of Article 9 GDPR and applicable guidance.
Is processing data revealing racial or ethnic origin simply prohibited under the GDPR?
Not exactly. Such data is treated as a special category under Article 9, and its processing is generally prohibited unless one of the specific conditions in Article 9(2) applies. This means processing is not absolutely forbidden, but it requires an applicable Article 9 condition in addition to a lawful basis under Article 6. It is a common misconception that consent is the only route; several other conditions may be available depending on context. Member state law can also introduce further conditions or limitations for certain special category data, so the position may vary by jurisdiction.
What do we need in place before processing data that may reveal racial or ethnic origin?
In most cases you should identify both an Article 6 lawful basis and a separate Article 9(2) condition, and document that analysis. Given the sensitivity, a Data Protection Impact Assessment under Article 35 may be appropriate where the processing is likely to result in a high risk, and this should be assessed on the facts. You should also confirm whether applicable national implementing law imposes additional safeguards. This is context and risk dependent, so verify the current requirements against the official text and relevant regulator guidance.
How should we handle situations where racial or ethnic origin is inferred rather than collected directly?
Where processing could reveal racial or ethnic origin through inference, the special category regime may apply even if you did not intend to collect such data. As a practical step, you should assess whether the outputs or combinations of data reveal such origin, and if so treat the processing accordingly, including identifying an Article 9(2) condition. Because the boundary of what counts as revealing this origin can involve recognized uncertainty, it is prudent to document your assessment and monitor evolving guidance from regulators.
Can we rely on consent to process this type of data, and what should we consider?
Consent, specifically explicit consent, is one of the conditions that may be available under Article 9(2), but it is not the only option and is not always the most appropriate. Where you rely on it, consent generally needs to meet the applicable standards for valid consent, and you should consider whether it can be freely given in the relevant context, for example in employment or other imbalance situations. Where consent is not suitable, you should assess whether another Article 9(2) condition applies. The precise standard and available conditions should be checked against the current official text.
Does this special category treatment apply to anonymous or aggregated data about ethnicity?
The GDPR generally applies to personal data of individuals and does not govern truly anonymous data. If data has been anonymised such that individuals are no longer identifiable, it typically falls outside the scope of the special category rules. However, the threshold for genuine anonymisation is demanding, and data that is only pseudonymised or that remains reasonably capable of re-identification is generally still personal data and, where it reveals racial or ethnic origin, remains within the special category regime. This determination is fact-specific and should be assessed carefully.

Common misconceptions

Only data that expressly labels someone's race or ethnicity falls into this category.
The category can, subject to assessment, extend to data from which racial or ethnic origin may be inferred. Whether particular data 'reveals' origin is fact-specific, and the boundary continues to be shaped by guidance and case law.
Consent is always required to process data revealing racial or ethnic origin.
Consent is one possible Article 9(2) condition, not a universal requirement. Other conditions may apply depending on context, and these must be paired with a distinct Article 6 lawful basis.
Having a lawful basis under Article 6 is sufficient to process this data.
For special category data, an Article 6 basis alone is generally not enough; a separate Article 9(2) condition typically must also be satisfied before processing is lawful.

Best practices

Identify and document both an Article 6 lawful basis and a distinct Article 9(2) condition before processing data that reveals racial or ethnic origin, rather than relying on one alone.
Assess whether data that does not expressly state origin might nonetheless reveal it by inference, and treat such data as special category where that risk is present.
Avoid defaulting to consent; evaluate which Article 9(2) condition genuinely fits the processing context and record the reasoning.
Check the applicable jurisdiction, as the UK GDPR and member state derogations may vary the conditions, safeguards, and national requirements that apply.
Confirm that data treated as out of scope is genuinely anonymous, since inadequately anonymised data may still fall within this category.
Monitor evolving regulatory guidance and case law on what 'reveals' racial or ethnic origin, and verify specific article references and conditions against the current official text.