GDPR Special Category Data: The Article 9 Conditions Explained

What counts as special category data

Article 9(1) GDPR prohibits the processing of:

personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
genetic data (Article 4(13): data on inherited or acquired genetic characteristics that give unique information about a person's physiology or health, in particular from a biological sample);
biometric data for the purpose of uniquely identifying a person (Article 4(14): data from specific technical processing of physical, physiological or behavioural characteristics, such as facial images or fingerprints);
data concerning health (Article 4(15): data on physical or mental health, including the provision of health care, that reveal information about health status);
data concerning a person's sex life or sexual orientation.

Recital 51 adds that photographs are not automatically special category data: they are biometric data only when processed through specific technical means that allow unique identification or authentication, as with face recognition.

Criminal records are separate: data on criminal convictions and offences is not in Article 9 but in Article 10, which allows processing only under official authority or where Union or Member State law authorises it with appropriate safeguards. Background checks therefore depend on national law.

Data can be special by inference

The Court of Justice reads Article 9(1) broadly. Three judgments matter for everyday processing:

Case	What the Court held
OT, C-184/20 (1 August 2022)	Publishing data that can indirectly disclose a person's sexual orientation, in that case the name of a spouse or partner, is processing of special category data
Meta Platforms v Bundeskartellamt, C-252/21 (4 July 2023)	Collecting data about visits to websites or apps that relate to a special category, and linking them to a user account, is special category processing where it allows such information to be revealed, whether it concerns the user or anyone else
Lindenapotheke, C-21/23 (4 October 2024)	Customer details entered when ordering pharmacy-only medicines online, such as name, delivery address and the product, are data concerning health, even when no prescription is needed

The practical test is therefore not only what a field is called, but what the data, alone or combined, allows someone to learn. An online shop selling pregnancy tests, a booking system for a therapy practice, or a tracking pixel on a page about a medical condition can all involve special category data.

The ten conditions in Article 9(2)

The ban does not apply if one of these conditions is met. Several only work together with Union or Member State law, so check your national data protection act as well.

Point	Condition	Typical use
(a)	Explicit consent for one or more specified purposes, unless Union or national law says the ban cannot be lifted by consent	Health apps, optional diversity surveys, biometric login offered as an alternative
(b)	Obligations and rights in employment, social security and social protection law, as authorised by Union or national law or a collective agreement with safeguards	Sick leave records, workplace adjustments, trade union deductions
(c)	Vital interests where the person is physically or legally incapable of giving consent	Medical emergencies
(d)	Legitimate activities of a not-for-profit body with a political, philosophical, religious or trade union aim, about members, former members or regular contacts, not disclosed outside without consent	Churches, unions, political parties
(e)	Data manifestly made public by the data subject	Narrow: see the Meta judgment below
(f)	Legal claims, or courts acting in their judicial capacity	Defending an employment or insurance claim
(g)	Substantial public interest on the basis of proportionate Union or national law with specific safeguards	Only where a law provides it, such as fraud or safeguarding rules
(h)	Preventive or occupational medicine, working capacity, diagnosis, health or social care, under law or a contract with a health professional, with the secrecy condition in Article 9(3)	Clinics, occupational health services
(i)	Public health under law with suitable safeguards, in particular professional secrecy	Cross-border health threats, medicine safety
(j)	Archiving, research or statistics in line with Article 89(1), on the basis of proportionate law	Scientific research under national research rules

Article 9(4) lets Member States keep or add conditions for genetic, biometric and health data. Check your national data protection act: its rules can be stricter than the GDPR text.

Explicit consent

Consent under point (a) must meet all the conditions of Articles 4(11) and 7, freely given, specific, informed, unambiguous and withdrawable, and in addition be explicit. The EDPB's consent guidelines (05/2020) describe this as an express statement: a signed written statement, or online an electronic form, an email, or a consent screen with Yes and No boxes and wording such as "I consent to the processing of my data", rather than consent inferred from conduct. The same guidelines consider consent problematic as a basis for processing employee data, because given the dependency at work it is unlikely to be freely given.

Manifestly made public

In Meta Platforms (C-252/21) the Court held that visiting websites or apps does not make the related data manifestly public. Entering data or clicking buttons such as Like or Share does so only if the user has explicitly chosen beforehand to make that data accessible to an unlimited number of people. A post shared with friends, or a profile you happen to be able to see, is not enough.

You still need an Article 6 basis

An Article 9(2) condition lifts the ban; it does not replace the lawful basis. In Krankenversicherung Nordrhein (C-667/21, 21 December 2023) the Court held that processing health data under Article 9(2)(h) must also satisfy at least one of the conditions in Article 6(1). Recital 51 says the same. Record both for each purpose, for example contract (Article 6(1)(b)) plus explicit consent (Article 9(2)(a)), or legal obligation (Article 6(1)(c)) plus employment law (Article 9(2)(b)). Our guide to the six lawful bases covers the first half.

The same judgment held that Article 9(3) does not by itself forbid colleagues of the data subject from accessing the data, but that the security principle in Articles 5(1)(f) and 32 may require it in practice. Limit access to those who need it.

Extra duties that follow

Duty	When special category data triggers it
Data protection impact assessment, Article 35(3)(b)	Processing on a large scale of special category data. Smaller scale processing can still need one under the EDPB criteria; see our DPIA guide
Data protection officer, Article 37(1)(c)	Your core activities consist of processing special category data on a large scale; see Do You Need a DPO?
Records of processing, Article 30(5)	The under-250-employees exemption does not apply if the processing includes special category data, so in practice almost every employer keeps a record
Automated decisions, Article 22(4)	Solely automated decisions with legal or similarly significant effects may use special category data only with explicit consent or substantial public interest, plus suitable safeguards
Security, Article 32	The risk is higher, so the measures should be too: encryption, strict access control, logging
Breach notification, Articles 33 and 34	A breach involving health or similar data is more likely to be a risk, and a high risk, to the people affected

Infringing Article 9 falls in the higher fine tier of Article 83(5)(a): up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

A five-step checklist

Find it. Go through your records of processing and flag every activity that involves Article 9 data, including what can be inferred from purchases, page visits, absences or photos.
Pick the condition. Record the Article 9(2) condition and the Article 6(1) basis for each purpose, and the national law provision where the condition needs one.
Minimise. Ask whether you need the data at all. A reason code for sick leave is often enough without a diagnosis.
Protect. Restrict access, encrypt, log access, and set a short retention period.
Assess. Run a DPIA screening, and update your privacy notice to name the categories and the conditions.

Assess high-risk processing properly. The Privacy Impact Assessment Bundle includes a DPIA template, a DPIA screening checklist and register, a transfer impact assessment template, a data protection by design checklist and a DPO consultation record.

GDPR Special Category Data: The Article 9 Conditions Explained

What counts as special category data

Data can be special by inference

The ten conditions in Article 9(2)

Explicit consent

Manifestly made public

You still need an Article 6 basis

Extra duties that follow

A five-step checklist

Sources

Related tools

DPIA Helper

Data Mapping Tool