Category: Special Category Data

Preventive or Occupational Medicine Basis

Also known as: Preventive medicine processing condition, Occupational medicine processing condition

Simply put

This is one of the specific reasons that can allow an organisation to process sensitive health data, where the processing is needed for preventive or occupational medicine purposes. Examples include assessing whether an employee is fit for work, or providing health and safety services in the workplace. It applies only when specific conditions are met, and normally requires that the data is handled by, or under the responsibility of, a professional bound by a duty of confidentiality; you should verify the exact wording against the current official text.

Formal definition

The preventive or occupational medicine basis refers to a condition permitting the processing of special category (health) data for purposes such as preventive medicine, occupational medicine, assessing the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems. Under the GDPR this condition sits within Article 9 as one of the additional conditions that must accompany a separate Article 6 lawful basis; the specific article number and its precise formulation should be confirmed against the current text, as national implementing law and member state derogations may impose further requirements. This condition typically applies only where the data are processed by, or under the responsibility of, a professional subject to an obligation of professional secrecy under Union or member state law, or by another person also subject to an equivalent confidentiality obligation. It does not, on its own, establish overall lawfulness: a controller must independently satisfy an Article 6 basis, and the scope of terms such as 'preventive medicine', 'occupational medicine', and 'assessing working capacity' is subject to interpretation and regulator guidance rather than being exhaustively defined in the Regulation. The occupational medicine dimension is generally understood to concern the interrelationship between workers' health and their workplaces, including prevention and treatment of occupational injuries and diseases and support for employee health and safety, while preventive medicine broadly concerns protecting, promoting, and maintaining health and preventing disease. Practitioners should treat the boundaries of this basis, and its interaction with employee-consent concerns, as context-dependent and subject to divergence between regulators.

Why it matters

The preventive or occupational medicine basis is one of the practical routes that allows organisations to handle health data in the employment and healthcare context without relying on employee consent, which regulators generally regard as problematic in employment relationships because of the imbalance of power between employer and worker. Where an organisation needs to assess whether an employee is fit for work, provide occupational health services, or support workplace health and safety, this condition can provide an Article 9 pathway for the special category (health) data involved. Getting the analysis right matters because misidentifying the applicable condition can leave otherwise routine occupational health processing without a valid legal footing.

The condition is also significant because it does not stand alone. A controller must still satisfy a separate Article 6 lawful basis and, in most cases, ensure the data are handled by or under the responsibility of a professional bound by an obligation of professional secrecy, or another person subject to an equivalent confidentiality obligation. Treating this condition as a blanket authorisation for any employer to process staff health data is a common misunderstanding; the confidentiality safeguard and the requirement for a distinct Article 6 basis are integral parts of the framework.

The boundaries of terms such as 'preventive medicine', 'occupational medicine', and 'assessing working capacity' are not exhaustively defined in the Regulation and are shaped by regulator guidance and national implementing law. Because member state derogations can impose additional requirements, and because the UK GDPR position may diverge from the EU position, practitioners should treat this basis as context-dependent and verify the precise wording and any national conditions against the current official text before relying on it.

Who it's relevant to

Occupational health providers

Providers delivering fitness-for-work assessments, workplace health and safety services, and the prevention and treatment of occupational injuries and diseases may rely on this condition for the health data they process. They should confirm that processing is carried out by or under the responsibility of a professional bound by an obligation of professional secrecy, and that a separate Article 6 basis is also satisfied.

Employers and HR functions

Employers assessing the working capacity of employees or arranging occupational health support should understand that this condition can provide an Article 9 route that does not depend on employee consent, which regulators generally view as problematic in the employment context. Employers should not treat the condition as blanket authorisation and should ensure the confidentiality safeguard and a distinct Article 6 basis are in place.

Data protection officers and privacy counsel

DPOs and privacy counsel advising on employee health data need to map the applicable Article 6 basis alongside this Article 9 condition, document the professional-secrecy safeguard, and account for national implementing law and member state derogations that may add requirements. They should also flag potential divergence between EU and UK GDPR positions and verify the precise wording against the current official text.

Healthcare and social care organisations

Organisations providing medical diagnosis, health or social care or treatment, or managing health or social care systems may fall within the broader scope of this condition. They should assess where the boundaries of terms such as 'preventive medicine' apply to their activities, recognising that these terms are interpreted through regulator guidance rather than exhaustively defined in the Regulation.

Inside Preventive or Occupational Medicine Basis

Article 9(2)(h) condition

The provision under GDPR Article 9(2)(h) that permits processing of special category data, including health data, for purposes such as preventive or occupational medicine, the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

Special category data trigger

This basis is specifically an Article 9 condition for processing special category data (typically health data). It supplements, rather than replaces, the requirement for a separate lawful basis under Article 6, both of which must generally be satisfied.

Professional secrecy safeguard (Article 9(3))

Reliance on the preventive or occupational medicine condition is generally conditional on the data being processed by, or under the responsibility of, a professional subject to an obligation of professional secrecy under EU or member state law or rules established by national competent bodies, or by another person also subject to such an obligation.

Basis in Union or member state law

The condition typically requires a foundation in EU or national law, or a contract with a health professional. Because member states may set additional conditions and limitations, including for health data, the precise scope can vary between jurisdictions and should be verified against national implementing law.

Purpose scope

The condition covers defined healthcare-related purposes such as preventive medicine, occupational medicine, assessment of an employee's working capacity, medical diagnosis, and the provision of care or treatment. It is not a general-purpose gateway for all employment or health-related processing.

Common questions

Answers to the questions practitioners most commonly ask about Preventive or Occupational Medicine Basis.

Does the preventive or occupational medicine basis remove the need for a lawful basis under Article 6?

No. This basis is one of the conditions under Article 9 that permits processing of special category (health) data, but it does not stand alone. In most cases you must also identify and satisfy a separate lawful basis under Article 6 for the same processing. The Article 9 condition and the Article 6 basis operate as two distinct requirements that both need to be met.

Is consent always required before processing health data for preventive or occupational medicine purposes?

Not necessarily. Consent is only one of several Article 9 conditions, and the preventive or occupational medicine condition is a separate route that does not depend on consent. Where this condition applies, processing may proceed without relying on consent, though you should still confirm which condition genuinely fits your purpose and assess whether consent or another condition is more appropriate. Consent is not a universal requirement, and you should verify the exact conditions against the current text of Article 9.

What safeguards typically need to be in place to rely on this basis?

This condition is generally available where the processing is carried out by, or under the responsibility of, a professional subject to an obligation of professional secrecy under Union or Member State law or rules established by national competent bodies, or by another person also subject to such an obligation. In practice this means confirming that the relevant confidentiality and secrecy obligations attach to the individuals handling the data, and documenting how that requirement is met. Because the precise formulation and any additional national conditions can vary, verify the applicable wording in Article 9 and relevant Member State law.

How does this basis interact with Member State derogations?

The GDPR allows Member States to introduce further conditions, including limitations, with regard to the processing of health data. As a result, the exact scope and any additional requirements for relying on the preventive or occupational medicine condition can differ between jurisdictions. Where processing spans multiple Member States, or where you operate under the UK GDPR, you should check the applicable national implementing law rather than assuming a single harmonised position.

What documentation should support reliance on this condition?

In most cases you should record which Article 9 condition you are relying on, the corresponding Article 6 lawful basis, and how the professional secrecy or equivalent confidentiality requirement is satisfied. It is also generally advisable to document the specific preventive or occupational medicine purpose, the categories of data involved, and any applicable national conditions. This supports the accountability principle and helps demonstrate that the condition genuinely applies to the processing in question.

Does relying on this basis remove the need to consider a Data Protection Impact Assessment?

No. Identifying a valid Article 9 condition addresses the lawfulness of processing special category data, but it is separate from the question of whether a Data Protection Impact Assessment under Article 35 is required. Large-scale or high-risk processing of health data may still trigger the need to assess whether a DPIA is necessary. You should evaluate the DPIA question independently and subject to assessment of the specific risks involved.

Common misconceptions

This condition alone makes health data processing lawful.

An Article 9 condition addresses only the additional requirement for special category data. A separate Article 6 lawful basis must generally also be identified, and both must be satisfied for the processing to be lawful.

Any employer can rely on this basis to process employee health data.

Reliance is generally tied to processing by or under the responsibility of a professional subject to an obligation of professional secrecy, and typically requires a basis in Union or member state law. General HR processing of health data by an employer without those safeguards does not straightforwardly fall within this condition, and national rules may impose further limits.

The scope is uniform across the EU.

Member states may introduce further conditions and limitations for processing health data, so the practical availability and boundaries of this basis can differ between jurisdictions, including any divergence under the UK GDPR and national implementing law.

Best practices

Identify and document a separate Article 6 lawful basis alongside the Article 9(2)(h) condition, and record why each applies to the specific processing.

Confirm that the data is processed by, or under the responsibility of, a person subject to a professional secrecy obligation, and document the source of that obligation.

Verify the specific national implementing law and any member state conditions or limitations that apply to health data in each relevant jurisdiction rather than assuming a uniform position.

Define and limit the processing to the covered purposes (for example, occupational medicine or working capacity assessment) and avoid using this condition to justify unrelated HR or analytics uses.

Assess whether a Data Protection Impact Assessment is required given the processing of special category data, and keep the assessment under review.

Periodically review reliance on this condition against current official text and regulatory guidance, as national derogations and interpretations can evolve.