Category: Special Category Data

Prohibition on Processing Special Categories

Also known as: General prohibition under Article 9, Article 9 prohibition, Prohibition on processing special category data

Simply put

Under the GDPR, there is a general rule that organisations must not process certain especially sensitive types of personal data, such as information revealing racial or ethnic origin, political opinions, or religious or philosophical beliefs. This is a default starting position that treats such data as off-limits because of its sensitive nature. Processing is only permitted where one of a limited set of specific conditions applies and appropriate safeguards are in place.

Formal definition

Article 9(1) GDPR (and the corresponding provision in the UK GDPR) establishes a general prohibition on the processing of special categories of personal data, being data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and other categories listed in the Article. The prohibition operates as the default position and is disapplied only where one of the exhaustive conditions in Article 9(2) is satisfied, such as explicit consent or certain employment and social protection purposes. Reliance on an Article 9 condition is separate from, and additional to, the requirement to identify a lawful basis under Article 6; per ICO guidance and other sources, appropriate safeguards may also be required. The precise conditions, associated safeguards, and any member state or national implementing requirements should be verified against the current text of Article 9 and applicable national law, as some conditions depend on further legislative provision and regulator guidance may vary.

Why it matters

Special category data carries a heightened risk of harm to individuals if it is misused, because information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, and other categories listed in Article 9 can expose people to discrimination, profiling, or other serious detriment. For this reason the GDPR treats such data as off-limits by default, reversing the usual assumption that processing may proceed where a lawful basis exists. Organisations that handle this data therefore start from a position of prohibition and must actively justify any processing against a narrow set of permitted conditions.

The practical significance is that identifying a lawful basis under Article 6 is not enough on its own. A separate and additional Article 9(2) condition must be satisfied before special category data may be processed, and per ICO guidance and other sources, appropriate safeguards may also be required. Getting this wrong is a common compliance failure point: an organisation may assume that consent or a contract covers all its processing, when in fact special category data demands a distinct justification such as explicit consent or an employment and social protection condition.

Because some Article 9 conditions depend on further legislative provision and can vary by member state or national implementing law, the compliance position is not uniform across jurisdictions. Regulator guidance may also differ in emphasis. Organisations should therefore treat Article 9 as a threshold analysis and verify the precise conditions and safeguards against the current text of Article 9 and applicable national law rather than relying on a general summary.

Who it's relevant to

Data Protection Officers and compliance leads

DPOs and compliance teams need to map where special category data is processed across the organisation and confirm that each processing activity has both an Article 6 lawful basis and a valid Article 9(2) condition, together with any required safeguards. They should treat the prohibition as the starting point and document the specific condition relied upon, verifying it against the current text of Article 9 and applicable national law.

Privacy and technology lawyers

Lawyers advising on data processing should distinguish the Article 9 condition analysis from the Article 6 lawful basis, since both are required for special category data. They should also flag that certain conditions depend on further legislative provision and can vary by member state or national implementing law, and that regulator guidance on safeguards may differ.

HR and employment teams

Employment processing frequently involves special category data, and the Article 9(2) conditions include certain employment and social protection purposes. HR teams should not assume that a general employment relationship or consent automatically permits processing such data, and should confirm which specific condition and safeguards apply, subject to national implementing requirements.

Engineers and system designers

Those building systems that ingest or store personal data should identify at the design stage whether any data falls within Article 9 categories, because the default position is prohibition. Where such data is in scope, appropriate technical and organisational safeguards may be required in addition to the applicable Article 9 condition, and the analysis should be verified with the compliance function.

Inside Prohibition on Processing Special Categories

General prohibition (Article 9(1))

Article 9(1) of the GDPR establishes a baseline prohibition on processing special categories of personal data. Processing is generally not permitted unless one of the specific conditions in Article 9(2) applies, in addition to an Article 6 legal basis.

Special categories of data

The prohibition covers data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, together with the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person's sex life or sexual orientation. The boundary of what 'reveals' such data can require case-by-case assessment.

Article 9(2) exceptions

The prohibition is lifted where one of the conditions in Article 9(2) is met. These include, among others, explicit consent, obligations in the field of employment and social security law, protection of vital interests where the data subject is incapable of giving consent, and reasons of substantial public interest. Each condition has its own requirements and should be assessed on its specific facts.

Interaction with an Article 6 legal basis

Satisfying an Article 9(2) condition does not, on its own, make processing lawful. An appropriate Article 6 legal basis is generally required in addition, so practitioners typically need to identify both.

Role of member state and national law

Several Article 9(2) conditions depend on, or may be further specified by, EU or member state law, and certain conditions require additional safeguards set by that law. The position can therefore vary between jurisdictions, and the UK GDPR together with national implementing law may diverge from the EU position.

Common questions

Answers to the questions practitioners most commonly ask about Prohibition on Processing Special Categories.

Is processing special category data always prohibited under the GDPR?

No. Article 9(1) sets out a general prohibition, but it is not absolute. Processing is permitted where one of the exceptions in Article 9(2) applies, such as explicit consent, reasons of substantial public interest, or purposes related to health or social care, among others. The prohibition is best understood as a default position that can be lifted only where a specific condition is satisfied, rather than a blanket ban. Note that some Article 9(2) conditions depend on member state or national implementing law, so the available exceptions can vary by jurisdiction and should be verified against the applicable text.

If I have consent under Article 6, does that also cover my processing of special category data?

Generally no. Article 6 and Article 9 operate as separate layers. To process special category data lawfully you typically need both a lawful basis under Article 6 and a separate condition under Article 9(2). Consent under Article 6 is not the same as the explicit consent standard referenced in Article 9(2)(a), and satisfying one requirement does not automatically satisfy the other. The two should be identified and documented independently, and you should confirm that any consent relied on meets the applicable standard.

How do I identify which Article 9(2) condition applies to my processing?

Start by confirming that the data actually falls within a special category as defined in Article 9(1), then map the specific purpose of the processing to the most appropriate condition in Article 9(2). Because several conditions depend on national or member state implementing law and may carry additional safeguards, you should check both the Regulation text and the relevant domestic provisions. Where more than one condition could apply, document the reasoning for the one relied on. This mapping is context and jurisdiction dependent and should be verified against the current official text.

What should I document to demonstrate that my reliance on an Article 9(2) condition is defensible?

In most cases you would record both the Article 6 lawful basis and the Article 9(2) condition relied on, the purpose of the processing, and any additional safeguards or national law requirements associated with that condition. Where the condition depends on substantial public interest or similar grounds, documenting the assessment supporting that characterisation is generally advisable. The precise documentation expectations can vary by regulator and by national implementing law, so treat records as something to align with the applicable guidance.

Does processing special category data affect whether I need to carry out a Data Protection Impact Assessment?

It can. Large scale processing of special category data is among the factors that typically point towards a Data Protection Impact Assessment under Article 35, though the DPIA obligation is a separate assessment from establishing an Article 9(2) condition. Satisfying an Article 9(2) condition does not by itself remove any DPIA obligation, and vice versa. Whether a DPIA is required depends on the nature, scope, context, and purposes of the processing and should be assessed against the relevant regulator's criteria.

How does the prohibition interact with obtaining explicit consent as the Article 9(2) condition?

Where explicit consent under Article 9(2)(a) is relied on to lift the prohibition, it generally needs to meet the standard for valid consent and be explicit in relation to the specified purpose. Reliance on consent also carries practical implications, such as the ability of the data subject to withdraw it, which may affect the continued lawfulness of the processing. Because consent is one of several possible conditions, you should assess whether another Article 9(2) condition is more appropriate and durable for your context. The suitability of consent is fact specific and subject to assessment.

Common misconceptions

Explicit consent is always required to process special category data.

Explicit consent is only one of several Article 9(2) conditions. Other conditions, such as those relating to employment law obligations, vital interests, or substantial public interest, may apply, and consent is not a universal requirement. The appropriate condition should be selected based on the specific processing.

Meeting an Article 9(2) condition is enough to make the processing lawful.

An Article 9(2) condition removes the prohibition, but a valid Article 6 legal basis is generally still needed. In most cases both must be satisfied for the processing to be lawful.

The special categories are a fixed, self-evident list that is easy to apply.

While the categories are set out in Article 9(1), determining whether particular data 'reveals' or 'concerns' a special category can require assessment. For example, data that indirectly reveals health or beliefs may fall within scope, so the classification is context dependent.

Best practices

Confirm whether the data genuinely falls within an Article 9(1) special category before designing processing, and document that assessment, treating borderline cases (such as data that indirectly reveals a category) with caution.

Identify and record both the applicable Article 9(2) condition and a separate Article 6 legal basis, since one is generally not sufficient without the other.

Check whether the chosen Article 9(2) condition depends on, or is further specified by, EU or member state law, and verify the applicable national or UK GDPR requirements rather than assuming a uniform position.

Where a condition requires additional safeguards or an appropriate policy document under national law, implement and document those safeguards.

Use qualified, evidence-based reasoning in internal records, noting any regulatory uncertainty or divergence, and avoid treating a single interpretation as settled law.

Verify the current official text of Article 9 and any relevant national provisions before relying on a specific condition, as details and guidance can evolve.