GDPR Special Category Data: A Compliance Guide

GDPR special category data carries the strictest processing rules in European data protection law. If your website or application collects health information, biometric identifiers, religious beliefs, or any of the other categories defined in Article 9 of the GDPR, you need specific legal grounds and robust safeguards before that data ever touches your servers.

This guide is educational content, not legal advice. For decisions affecting your organisation, consult a qualified data protection lawyer. That said, the information below covers the practical steps most businesses need to understand when handling special category data under GDPR.

What Is GDPR Special Category Data?

Special category data is a defined set of personal data types that the GDPR considers inherently sensitive. Article 9(1) prohibits processing these categories unless one of 10 specific exceptions applies. The regulation treats this data differently because its misuse poses heightened risks to individual rights and freedoms.

The complete list of special category data under GDPR includes:

• Racial or ethnic origin including nationality indicators and ethnic background
• Political opinions such as party membership or voting preference data
• Religious or philosophical beliefs including atheism and moral convictions
• Trade union membership whether current or historical
• Genetic data meaning DNA sequences, hereditary information, or genetic test results
• Biometric data when used to uniquely identify a person (fingerprints, facial recognition, retina scans)
• Health data covering physical conditions, mental health, medical history, and healthcare service usage
• Sex life or sexual orientation including relationship status data that reveals orientation

Criminal conviction data is handled separately under Article 10 and carries its own restrictions, though businesses often group it alongside special categories in their compliance programmes.

How Special Category Data Differs from Ordinary Personal Data

Standard personal data such as names, email addresses, and IP addresses can be processed under any of the six lawful bases in Article 6 of the GDPR. Special category data requires a two-layer justification. You need both a valid Article 6 basis and a separate Article 9(2) condition.

This dual requirement means that even if you have a legitimate interest in processing health data, that alone is not sufficient. You must also satisfy one of the Article 9 conditions, such as explicit consent or a legal obligation related to employment law.

The practical impact is significant. Processing that would be straightforward with ordinary data, such as collecting user preferences or contact details, becomes a structured compliance exercise when special categories are involved. Documentation requirements increase, security expectations rise, and supervisory authorities scrutinise this processing more closely during investigations.

The 10 Conditions for Processing Special Category Data

Article 9(2) of the GDPR lists 10 exhaustive conditions that permit processing. You must rely on at least one of these in addition to your Article 6 lawful basis.

1. Explicit Consent

The data subject has given explicit consent to the processing for one or more specified purposes. "Explicit" requires a clear, affirmative statement. Pre-ticked boxes, silence, or bundled consent do not qualify. You must also allow withdrawal at any time without detriment.

2. Employment, Social Security, and Social Protection Law

Processing is necessary for obligations and rights under employment, social security, or social protection law. This covers employee health records, disability accommodations, and workplace monitoring required by national legislation.

3. Vital Interests

Processing is necessary to protect the vital interests of the data subject or another person where the data subject is physically or legally incapable of giving consent. This applies in genuine emergency situations, not routine business operations.

4. Legitimate Activities of Certain Bodies

Processing is carried out by a foundation, association, or not-for-profit body with a political, philosophical, religious, or trade union aim, and relates solely to members or former members. Data cannot be disclosed outside the body without consent.

5. Data Made Manifestly Public

The data subject has manifestly made the data public. This could include information shared in public speeches, social media posts made without access restrictions, or published interviews. The scope is narrow and context-dependent.

6. Legal Claims

Processing is necessary for the establishment, exercise, or defence of legal claims, or whenever courts are acting in their judicial capacity. This covers litigation holds, evidence preservation, and dispute resolution.

7. Substantial Public Interest

Processing is necessary for reasons of substantial public interest, based on EU or member state law. This requires a proportionality assessment and specific safeguards. National laws define what qualifies.

8. Health and Social Care

Processing is necessary for preventive or occupational medicine, medical diagnosis, healthcare provision, or health system management. This must be carried out by or under the responsibility of a professional subject to confidentiality obligations.

9. Public Health

Processing is necessary for reasons of public interest in public health, such as protecting against serious cross-border health threats or ensuring high standards of quality and safety for medicinal products and medical devices.

10. Archiving, Research, and Statistics

Processing is necessary for archiving purposes in the public interest, scientific or historical research, or statistical purposes, subject to appropriate safeguards including data minimisation and pseudonymisation where possible.

Practical Steps to Comply with Special Category Data GDPR Requirements

Knowing the legal framework is only half the task. Implementing compliant processing requires concrete operational steps.

Step 1: Data mapping. Identify every point where your systems collect, store, or process special category data. Include web forms, cookie tracking that might capture health-related browsing, customer support tickets, and third-party integrations.

Step 2: Justify each processing activity. For every instance you identified, document both the Article 6 lawful basis and the Article 9(2) condition you rely on. Record this in your Records of Processing Activities (ROPA).

Step 3: Update your privacy policy. Your privacy notice must specifically describe the special categories you process, the purposes, and the legal grounds. A privacy policy generator can help you create the baseline structure, but you will need to add specific language about special category data manually.

Step 4: Implement explicit consent mechanisms. If you rely on consent as your Article 9 condition, build granular consent flows. Each category and purpose needs its own opt-in. Store timestamped consent records with the exact wording shown to the user.

Step 5: Conduct a DPIA. Article 35(3)(b) of the GDPR explicitly requires a Data Protection Impact Assessment for large-scale processing of special categories. Document the necessity, proportionality, risks, and mitigations.

Step 6: Apply enhanced security controls. Encryption at rest and in transit, role-based access control, audit logging, data segregation, and regular access reviews are the baseline. Many supervisory authorities expect pseudonymisation and aggregation where feasible.

Security and Technical Safeguards for Special Category Data

The GDPR does not prescribe specific technologies, but Article 32 requires measures "appropriate to the risk." For special category data, the risk is inherently higher, so the expected standard of protection rises accordingly.

Essential safeguards include:

• Encryption for data at rest (AES-256 or equivalent) and in transit (TLS 1.2+)
• Access controls using the principle of least privilege, enforced through role-based access
• Audit logging of all access to special category data, with tamper-proof storage
• Data segregation separating special category data from general personal data at the storage level
• Pseudonymisation replacing direct identifiers with tokens where full identification is not required
• Retention limits with automated deletion or anonymisation schedules
• Incident response procedures specific to special category data breaches, including the 72-hour notification requirement under Article 33

Organisations using compliance tools like TermsBox can automate parts of this process. A website compliance scanner can detect when cookies or third-party scripts might inadvertently capture sensitive browsing data, helping you address gaps before they become enforcement risks.

Common Mistakes When Handling Special Category Data GDPR

Several recurring errors lead to enforcement action and fines.

Relying on standard consent instead of explicit consent. A general "I agree to the privacy policy" checkbox does not meet the explicit consent threshold for special category data. You need specific, informed, and unambiguous statements of agreement for each processing purpose.

Failing to recognise inferred special category data. You might not collect health data directly, but if your analytics track visits to pages about specific medical conditions, you may be creating health-related profiles. Context matters. The Article 29 Working Party (now the EDPB) has confirmed that inferred data can qualify as special category data.

Ignoring the dual-basis requirement. Some organisations identify an Article 6 basis but forget the Article 9 condition, or vice versa. Both are required. An incomplete legal justification is the same as no justification.

Inadequate consent withdrawal mechanisms. If you collect special category data with explicit consent, withdrawal must be as easy as giving consent. Burying the option in account settings or requiring email requests does not meet GDPR standards.

No DPIA when one is required. Skipping the impact assessment for large-scale special category processing is itself a violation, separate from any issues with the processing itself.

Data Subject Rights and Special Category Data

Data subjects retain all standard GDPR rights when their special category data is processed, but some rights carry additional weight in this context.

The right to erasure under Article 17 is particularly relevant. When someone withdraws consent for special category data processing, you must delete the data promptly unless another legal ground applies. The "without undue delay" standard is interpreted strictly for sensitive data.

The right to data portability under Article 20 applies when processing is based on consent and carried out by automated means. For health data in particular, this right supports individuals moving their records between service providers.

The right to object does not apply to processing based on explicit consent (since withdrawal serves the same function), but it does apply to processing based on public interest grounds under Article 9(2)(g) or (j).

Your privacy policy should clearly explain how data subjects can exercise each right, with specific instructions for special category data requests. Response timelines remain one month under Article 12(3), but the sensitivity of the data means supervisory authorities expect faster handling where possible.

Cross-Border Transfers of Special Category Data

Transferring special category data outside the EEA adds another compliance layer. Standard transfer mechanisms apply, including adequacy decisions, Standard Contractual Clauses (SCCs), and Binding Corporate Rules, but the Transfer Impact Assessment must account for the heightened sensitivity.

The EDPB has clarified that supplementary measures for special category transfers should be more robust than for ordinary personal data. This might include additional encryption requirements, restrictions on government access, and contractual prohibitions on secondary use.

For businesses operating internationally, this means mapping not just where data is stored, but where every processor and subprocessor accesses it from. Cloud infrastructure, customer support teams, and analytics platforms all need scrutiny.

Frequently Asked Questions

What qualifies as special category data under GDPR?

Article 9 of the GDPR defines special category data as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation.

Can I process special category data with legitimate interests?

No. Legitimate interests alone cannot justify processing special category data. You must satisfy one of the 10 specific conditions listed in Article 9(2), such as explicit consent, employment law obligations, or substantial public interest, in addition to a standard lawful basis under Article 6.

Is a DPIA required for special category data processing?

A Data Protection Impact Assessment is required under Article 35 whenever processing is likely to result in a high risk to individuals. Large-scale processing of special category data is explicitly listed as a trigger, so most organisations handling this data at scale will need one.

What are the penalties for mishandling special category data?

Violations of the special category data provisions fall under the higher tier of GDPR fines: up to 20 million EUR or 4% of annual global turnover, whichever is greater. Supervisory authorities also have the power to issue processing bans.