Skip to main content
Privacy Track
Category: Special Category Data

Substantial Public Interest

Also known as: Reasons of substantial public interest, Substantial public interest condition
Simply put

Substantial public interest is one of the specific grounds an organisation can rely on to lawfully process sensitive (special category) personal data where there is a real and significant benefit to society. It is not enough for the benefit to be trivial or vague; the public interest must be genuine and of real substance. This condition applies in addition to a separate lawful basis, because sensitive data carries higher risks and needs extra justification.

Formal definition

Substantial public interest is a processing condition for special category data under Article 9(2)(g) of the UK GDPR (and the equivalent EU GDPR provision), which permits processing of sensitive data where necessary for reasons of substantial public interest, subject to a basis in domestic law that is proportionate and provides appropriate safeguards. Per ICO guidance, 'substantial' requires the public interest to be real and of substance rather than trivial; the mere existence of some public benefit is insufficient given the inherent risks of special category data. In the UK, reliance on this condition generally requires satisfying one of the specific substantial public interest conditions set out in national implementing law and, in most cases, an accompanying appropriate policy document. This condition supplements, and does not replace, the requirement for an Article 6 lawful basis. The precise substantial public interest conditions and any additional requirements are set by domestic/member state law and may vary; practitioners should verify the applicable conditions and safeguards against the current official text and relevant regulator guidance.

Why it matters

Special category data, such as information about health, ethnicity, religious beliefs, or sexual orientation, carries higher risks to individuals if mishandled, so the GDPR imposes an additional layer of justification on top of the ordinary Article 6 lawful basis. The substantial public interest condition matters because it is one of the recognised routes that allows organisations to process this sensitive data where there is a genuine and significant societal benefit, rather than requiring individual consent, which is often impractical or inappropriate in fields like fraud prevention, safeguarding, or the public functions of certain bodies.

The word 'substantial' is doing real work here. According to ICO guidance, the public interest must be real and of substance, not trivial or merely asserted. Given the inherent risks of special category data, the mere existence of some public benefit is generally insufficient to meet the threshold. This raises the evidential bar for controllers: they cannot rely on a vague or aspirational claim of public benefit and must be able to demonstrate why the interest is genuinely weighty and why the processing is necessary to serve it.

Because the detailed substantial public interest conditions are set by domestic and member state implementing law, the position can vary between jurisdictions and may change over time. In the UK, reliance typically requires meeting one of the specific conditions set out in national law and, in most cases, having an appropriate policy document in place. Practitioners should therefore treat this condition as context-dependent and verify the applicable conditions, safeguards, and any additional documentation requirements against the current official text and relevant regulator guidance.

Who it's relevant to

Data Protection Officers and compliance leads
DPOs and compliance teams need to identify whether a proposed processing activity involving special category data can genuinely meet the substantial public interest threshold, and to confirm that a specific condition in domestic law applies. In the UK this typically includes preparing and maintaining an appropriate policy document where required. They should treat the 'substantial' standard as a real evidential hurdle rather than a formality.
Privacy and data protection lawyers
Legal advisers assess whether reliance on Article 9(2)(g) is defensible, whether the necessity and proportionality tests are met, and whether the required basis in domestic law and appropriate safeguards are present. Because the specific conditions are set by national implementing law and may differ between the UK and EU member states, advisers should verify the applicable conditions against the current official text rather than assuming uniformity.
Public bodies and organisations performing public interest functions
Bodies such as universities and other organisations carrying out public interest tasks may rely on this condition where processing sensitive data is necessary to fulfil those functions. They should ensure the public interest they invoke is real and of substance, map it to a specific condition in domestic law, and pair it with an appropriate Article 6 lawful basis and any required documentation.
Engineers and product teams handling sensitive data
Technical teams designing systems that process special category data should understand that meeting this condition depends on documented safeguards and a valid legal foundation, not solely on technical controls. Early engagement with DPOs helps ensure necessity, proportionality, and safeguards are built into the design and can be evidenced if the reliance is later scrutinised.

Inside Substantial Public Interest

Article 9 condition for special category data
Substantial public interest is one of the conditions in Article 9(2) that can lift the general prohibition on processing special category data. It appears at Article 9(2)(g) and applies where processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law.
Legal basis under Member State or Union law
Reliance on this condition generally requires a supporting basis in Union or Member State law that is proportionate to the aim pursued, respects the essence of the right to data protection, and provides for suitable and specific measures to safeguard fundamental rights and interests. The specific conditions are frequently set out in national implementing law and may vary between member states.
Necessity and proportionality
The processing must be necessary for the stated substantial public interest, not merely useful or convenient. Necessity is assessed against whether the objective could reasonably be achieved by less intrusive means, and this is subject to case-by-case assessment.
Not a standalone Article 6 lawful basis
This condition sits under Article 9 and addresses the additional requirement for special category data. It does not replace the need for a lawful basis under Article 6; controllers generally need to identify both an Article 6 basis and an Article 9 condition.
Safeguards requirement
The condition is typically accompanied by a requirement for suitable and specific measures to safeguard the data subject's rights, which may be specified in the relevant national law. The precise safeguards depend on the applicable legal instrument and should be verified against the current text.

Common questions

Answers to the questions practitioners most commonly ask about Substantial Public Interest.

Does relying on 'substantial public interest' mean I do not need consent to process special category data?
Not exactly. Substantial public interest is one of the conditions under Article 9 that can permit processing of special category data as an alternative to explicit consent, but it is not a blanket exemption from consent. You still need a lawful basis under Article 6 in addition to the Article 9 condition, and in the UK GDPR context this condition generally requires you to meet a specific basis set out in national implementing law and, in most cases, to have an appropriate policy document and safeguards in place. Whether it applies is subject to assessment against the relevant statutory conditions, so consent may still be the more appropriate route depending on the circumstances.
Is 'substantial public interest' a single, self-contained legal basis I can cite on its own?
No. It is better understood as a gateway that must be grounded in a more specific condition. Under the GDPR framework, this Article 9 condition generally must be authorised by Union or member state law, meaning you typically point to a particular basis in national implementing legislation rather than to the phrase alone. It also does not replace your Article 6 lawful basis, which remains separately required. Treating it as a standalone justification, without identifying the underlying statutory condition and accompanying safeguards, is a common source of error and should be avoided.
How do I identify which specific substantial public interest condition applies to my processing?
Start by mapping your processing purpose against the specific conditions enumerated in the applicable national implementing law, since the general reference to substantial public interest is typically operationalised through a defined list. Document why your purpose falls within a particular condition and confirm that each element of that condition is satisfied. Because the available conditions and their wording can vary between member states, and the UK position may differ from the EU position, you should verify the current statutory text for your jurisdiction rather than assume a condition transfers across borders.
What documentation should I have in place when relying on this condition?
In addition to recording your Article 6 lawful basis and your Article 9 condition in your records of processing, many national frameworks require an appropriate policy document explaining how you comply with data protection principles and your retention and erasure approach for the relevant data. Depending on the nature and risk of the processing, a Data Protection Impact Assessment under Article 35 may also be appropriate. You should confirm the specific documentation obligations against the current official text applicable to your jurisdiction, as requirements can differ.
Can I rely on substantial public interest for large-scale or high-risk processing?
Potentially, but it is subject to assessment. The condition does not by itself authorise any level of risk; you must still demonstrate that the processing is necessary and proportionate to the identified purpose and accompanied by appropriate safeguards. Large-scale or high-risk processing generally strengthens the case for conducting a DPIA and for implementing stronger technical and organisational measures. Necessity and proportionality are context dependent, so the same condition may support one processing activity and not another.
How should I handle differences between the EU and UK positions when operating across both?
Treat the two frameworks separately rather than assuming alignment. The conditions available under substantial public interest, and the accompanying safeguards and documentation requirements, may be set out differently in EU member state law and in UK implementing law, and member state derogations can vary the position within the EU. For cross-border operations, identify the applicable condition and its requirements for each jurisdiction independently and verify each against the current official text, noting where the boundaries of the condition differ.

Common misconceptions

Substantial public interest is a general-purpose justification that lets an organisation process special category data whenever it considers the purpose important.
It is a defined Article 9(2)(g) condition that generally must be grounded in Union or Member State law, be necessary and proportionate, and be accompanied by appropriate safeguards. An organisation's own view that a purpose is worthwhile is not sufficient, and the specific permitted grounds are often narrowed by national implementing law.
Relying on substantial public interest removes the need to identify any other legal basis.
This condition addresses only the additional requirement for special category data under Article 9. A separate lawful basis under Article 6 is generally still required, so both should be identified and documented.
The meaning and scope of substantial public interest are uniform across the EU and the UK.
Because the condition depends on Union or Member State law, the specific grounds and safeguards can diverge between member states, and the position under the UK GDPR and its national implementing law may differ. Practitioners should check the applicable jurisdiction rather than assume a single settled meaning.

Best practices

Identify and document the specific Union or Member State legal provision relied upon, rather than citing substantial public interest in the abstract.
Pair the Article 9 condition with a clearly identified Article 6 lawful basis and record both in your processing documentation.
Carry out and document a necessity and proportionality assessment, considering whether a less intrusive means could achieve the same objective.
Implement and record the suitable and specific safeguards required by the applicable law, and review them periodically.
Verify the applicable national implementing law for the relevant jurisdiction, noting that grounds and safeguards can vary between member states and may differ under the UK regime.
Confirm the current official text and any regulator guidance before relying on this condition, as specific conditions and interpretations can evolve.