Special category data is the group of personal data types that the GDPR treats as especially sensitive, because their misuse can lead to discrimination, exclusion or serious harm to a person’s fundamental rights. In privacy law, the term comes from Article 9 of the General Data Protection Regulation, which prohibits processing these data unless the controller has both a lawful basis and one of a closed list of additional conditions.
The concept is a core building block of privacy fundamentals in Europe and in laws modeled on the GDPR. It is often called sensitive personal data, the term used in earlier European and United Kingdom legislation, and it has close but not identical counterparts in other jurisdictions.
Which data types are special category data
Article 9(1) of the GDPR lists eight categories of special category data. The list is exhaustive: data outside it are not special category data, even if a person considers them private, although they may still require careful protection.
| Category | Examples | Typical context |
|---|---|---|
| Racial or ethnic origin | Ethnicity recorded in a diversity survey | HR monitoring, research |
| Political opinions | Party membership, campaign donations | Political organizations, profiling |
| Religious or philosophical beliefs | Religious affiliation, dietary rules linked to faith | Employers, communities, events |
| Trade union membership | Union dues deducted from salary | Payroll, employee relations |
| Genetic data | DNA test results | Healthcare, ancestry services |
| Biometric data for unique identification | Fingerprint or face templates used for access | Workplace access, device authentication |
| Health data | Diagnoses, sick notes, fitness tracker readings | Healthcare, insurance, HR |
| Sex life or sexual orientation | Information in dating profiles | Dating apps, health services |
Two nuances matter. Biometric data counts as special category data only when it is processed to uniquely identify a person; an ordinary photo is not automatically biometric data. And data that reveal a category by inference, such as purchases that indicate a medical condition, can fall under Article 9 when the controller processes them to draw that conclusion.
How Article 9 conditions work
Processing special category data requires a double test. The controller first needs a lawful basis under Article 6, such as contract or legal obligation, and then must satisfy one of the conditions in Article 9(2). Without both, processing is unlawful even when the data are well secured.
| Condition | What it covers | Practical example |
|---|---|---|
| Explicit consent | Clear, specific, affirmed consent | User opts in to share health data with an app |
| Employment and social security law | Obligations under employment law | Recording sickness absence for statutory pay |
| Vital interests | Protecting life when consent cannot be given | Sharing medical data with emergency services |
| Data made manifestly public | Data the person deliberately published | A politician’s declared party affiliation |
| Legal claims | Establishing or defending claims | Medical records in a personal injury case |
| Substantial public interest | Purposes defined in member state law | Equality monitoring, fraud prevention |
| Health and social care | Diagnosis, treatment, care management | Hospital patient records |
| Research and archiving | Scientific, historical or statistical purposes | Clinical studies with safeguards |
Explicit consent is a higher standard than ordinary consent. It requires an express statement, such as a separate checkbox or signed form, and it is often unsuitable for employers, because the imbalance of power means employee consent is rarely freely given.
Special category data compared with related concepts
Special category data overlaps with several neighboring concepts in privacy. Confusing them leads to either over-protection that blocks legitimate work or under-protection that creates legal risk.
| Term | Legal source | Relationship to special category data |
|---|---|---|
| Personal data | GDPR Article 4 | The broader set; special categories are a subset |
| Criminal conviction and offense data | GDPR Article 10 | Separate regime, not a special category |
| PII | United States usage | Focuses on identifiability, not sensitivity |
| Sensitive personal information | CCPA as amended by the CPRA | Wider list, including government ID numbers and precise geolocation |
| Financial data | Sector rules and security standards | Sensitive in practice, but not an Article 9 category |
A common misconception is that bank account numbers or national ID numbers are special category data under the GDPR. They are not, although they require strong security and may face specific national rules.
Additional obligations for controllers
Processing special category data raises the compliance burden well beyond the Article 9 condition itself. Controllers are expected to apply stronger safeguards in proportion to the higher risk.
- Data protection impact assessment (DPIA) is mandatory for large-scale processing of special category data.
- Data protection officer must be appointed when core activities involve large-scale processing of these data.
- Data minimization is applied strictly: collect only what the purpose requires and avoid inferring sensitive traits.
- Access controls and encryption should limit who can see the data and protect it in storage and transit.
- Records of processing must document the Article 9 condition relied on.
- Breach assessment should treat exposure of these data as high risk to individuals.
Some national laws add further rules. Member states may introduce additional conditions or limitations for genetic, biometric and health data, so organizations operating in several countries must check local requirements.
Common mistakes in practice
Most problems arise because organizations do not recognize that they process special category data at all. Health information in employee records, biometric clocking systems and free-text fields in customer support tools are frequent blind spots.
- Relying on ordinary consent instead of explicit consent or another valid Article 9 condition.
- Ignoring inferred data produced by analytics, advertising segments or recommendation systems.
- Using biometrics for convenience without assessing whether a less intrusive method would work.
- Over-sharing internally, such as giving managers full medical details when only fitness-for-work status is needed.
- Keeping data too long after the purpose, such as a completed recruitment process, has ended.
A plain-language summary
Some information about you is especially personal: your health, your religion, your sexual orientation, your political views or your fingerprints. European law calls these special category data and protects them more strictly than your name or email address.
An organization may use such information only in specific, narrowly defined situations, such as providing medical care, meeting an employment law duty or with your clear and explicit agreement. Even then, it must guard the data especially carefully.
An example from practice
A logistics company wanted to replace badge cards with fingerprint scanners at its warehouse entrances. Its data protection officer pointed out that fingerprint templates used to identify employees are biometric data under Article 9, and that employee consent would be doubtful because staff could hardly refuse.
The company carried out a data protection impact assessment, concluded that badge cards already met the security goal for most areas, and limited fingerprint access to a single high-security room for a small group of staff who could choose a PIN-based alternative. Templates were stored only on the local reader, encrypted and deleted when access rights ended. The project went ahead with a far smaller footprint and documented reasoning that could withstand a regulator’s review.