Article 9 GDPR: A Practical Guide to Special Category Data

What Article 9 GDPR Covers

Article 9 of the General Data Protection Regulation establishes stricter rules for a specific class of personal data. It addresses information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and data concerning health, sex life, or sexual orientation. The regulation also explicitly protects genetic data and biometric data when used to identify a person. Because this data is considered particularly sensitive, the GDPR sets a default prohibition on its processing unless a specific condition is met.

Controllers and processors must treat Article 9 data as a distinct category with heightened protection. Failing to recognize the boundary between ordinary personal data and special category data is a common compliance gap that can lead to significant regulatory risk.

The Default Rule and Lawful Bases

Under Article 9(1), processing special category data is prohibited unless one of the conditions in Article 9(2) applies. This is a higher bar than the general lawful bases under Article 6, which apply to all personal data.

• Explicit consent from the data subject
• Necessary for employment, social security, and social protection law
• Necessary to protect vital interests where the data subject is incapable of giving consent
• Processing carried out by a not-for-profit body with appropriate safeguards
• Data made manifestly public by the data subject
• Necessary for legal claims or judicial acts
• Substantial public interest with a basis in Union or Member State law
• Necessary for preventive or occupational medicine, provided a professional subject to a legal obligation of secrecy processes the data
• Necessary for public health purposes and archiving in the public interest
• Necessary for scientific or historical research purposes or statistical purposes

Each condition carries its own requirements. For example, explicit consent must be freely given, specific, informed, and unambiguous. Substantial public interest relies on a lawful basis in Member State law that respects the essence of the right. The burden of proof rests on the data controller to demonstrate which condition applies.

Health Data and Biometrics in Practice

Health data receives particularly close scrutiny under Article 9. The definition is broad and covers data about the physical or mental health of a person, the provision of health care, and the registration of that provision. Genetic data and biometric data used for identification also fall squarely within this category.

Organizations in the healthcare, life sciences, and wellness sectors must map their processing activities carefully. An app that collects heart rate data may process health data depending on the context and purpose. A workplace wellness program that uses biometric scans needs a clear legal basis and proportionate safeguards. In both cases, relying on legitimate interests alone is insufficient; the controller must identify an Article 9(2) condition that matches the specific processing activity.

Exemptions and Sector-Specific Rules

Article 9(3) provides specific exemptions for employee data, allowing processing where necessary for obligations and rights under employment, social security, and social protection law, provided safeguards exist for the data subject's essential interests. Member States may also introduce further conditions and restrictions through national law, particularly in areas like criminal law, national security, and financial regulation.

The European Data Protection Board has issued guidance clarifying that exemptions must be interpreted strictly. A broad internal policy does not justify processing special category data without a valid Article 9(2) condition. Data Protection Authorities expect controllers to document their reasoning and conduct a Data Protection Impact Assessment where processing is likely to result in a high risk to individuals.

Accountability and Technical Measures

Controllers must implement appropriate technical and organizational measures to protect special category data. The GDPR requires measures such as pseudonymization, encryption, access controls, and regular testing of security arrangements. These steps are not optional when handling Article 9 data.

Documentation is equally important. Records of processing activities under Article 30 should clearly identify special category data, the applicable condition for processing, and the safeguards in place. This documentation supports accountability and demonstrates compliance to regulators in the event of an inquiry or breach investigation.