> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What are "Special Categories of Data" under the GDPR?
- URL: https://www.thedelatorrereview.com/what-are-special-categories-of-data-under-the-gdpr/
- Published: 2019-02-05T00:36:00.000Z
- Updated: 2026-07-14T00:40:24.000Z
- Description: Special category data receives enhanced protection under the GDPR due to its sensitive nature. This article explains what qualifies as special category data, the relationship between Articles 6 and 9, the Article 9 processing conditions, and the safeguards controllers should apply.
- Author: Lydia
- Tags: GDPR, Lawful Basis, Special Category Data, Sensitive Information, EU, Data Protection Law, Data Protection Impact Assessment (DPIA) / Privacy Impact Assessment (PIA)

> **Key points:** Special category data (Article 9 of GDPR) includes **sensitive personal data** that receives **enhanced protection under the GDPR.** (2) To process special category data lawfully, controllers **must identify both a lawful basis under Article 6 and a condition for processing under Article 9**. These requirements are separate and do not need to correspond. (3) Article 9 provides 10 conditions for processing special category data. (4) Controllers should identify and document the applicable Article 9 condition before processing begins and, where required by law, maintain an appropriate policy document. (5) Processing special category data often presents **higher risks** to individuals. Controllers should assess those risks and conduct a **Data Protection Impact Assessment (DPIA)** whenever the processing is likely to result in a high risk to individuals' rights and freedoms.

### Special categories of data and criminal records

To prevent discrimination, EU data protection law imposes additional restrictions on the processing of special categories of data. Article 9 defines special category data as personal data revealing:

- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data used for the purpose of uniquely identifying a natural person;
- health data;
- data concerning a person's sex life; and
- data concerning a person's sexual orientation.

**Data relating to criminal convictions and offenses** is not classified as special category data. Instead, it is governed by a separate legal regime under Article 10 of the GDPR. The European Union is not competent to legislate on criminal law matters. That legal field falls within the exclusive scope of Member State law. Article 10 requires that data on criminal convictions be processed only ‘*only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects”*. In addition, *“\[a\]ny comprehensive register of criminal convictions shall be kept only under the control of official authority.”*

Special category data includes not only information that directly reveals these characteristics, but also **information from which they can be inferred**. Where a controller intentionally draws or relies upon an inference that reveals one of these protected characteristics—or intentionally treats an individual differently based on such an inference—the inferred information may itself constitute special category data and be subject to Article 9 of the GDPR.

### What are the rules for special category data?

Regardless of the applicable Article 9 condition, controllers must ensure that the processing complies with all of the GDPR's general requirements, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Processing special category data therefore requires both a lawful basis under Article 6 and a condition for processing under Article 9.

Article 9(2) of the GDPR establishes **ten conditions** under which controllers may process special category data:

- Explicit consent;
- Employment, social security, and social protection obligations or rights;
- Vital interests where the data subject is physically or legally incapable of giving consent;
- Activities of not-for-profit organizations;
- Data manifestly made public by the data subject;
- Legal claims or judicial proceedings;
- Substantial public interest;
- Preventive or occupational medicine, health, or social care;
- Public health; and
- Archiving in the public interest, scientific or historical research, or statistical purposes.

Several of these conditions require that the processing be **authorized by Union or Member State law**, which may establish additional requirements, safeguards, or limitations. Controllers relying on these conditions should therefore verify the applicable national legislation before processing special category data.

Consent of the data subject enables processing of special categories of data but only if it is express. 

Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.

Before processing begins, controllers should **identify and document** the applicable Article 9 condition. They should also assess whether the processing is **likely to result in a high risk** to individuals' rights and freedoms and, where appropriate, conduct a **Data Protection Impact Assessment (DPIA)**.

### 

### Additional Resources

[Article 9 ](https://gdpr-info.eu/art-9-gdpr/?ref=thedelatorrereview.com)of GDPR

Suitable Recitals [(46) Vital Interests of the Data Subject](https://gdpr-info.eu/recitals/no-46/?ref=thedelatorrereview.com) [(51) Protecting Sensitive Personal Data](https://gdpr-info.eu/recitals/no-51/?ref=thedelatorrereview.com) [(52) Exceptions to the Prohibition on Processing Special Categories of Personal Data](https://gdpr-info.eu/recitals/no-52/?ref=thedelatorrereview.com) [(53) Processing of Sensitive Data in Health and Social Sector](https://gdpr-info.eu/recitals/no-53/?ref=thedelatorrereview.com) [(54) Processing of Sensitive Data in Public Health Sector](https://gdpr-info.eu/recitals/no-54/?ref=thedelatorrereview.com) [(55) Public Interest in Processing by Official Authorities for Objectives of Recognized Religious Communities](https://gdpr-info.eu/recitals/no-55/?ref=thedelatorrereview.com) [(56) Processing Personal Data on People's Political Opinions by Parties](https://gdpr-info.eu/recitals/no-56/?ref=thedelatorrereview.com)

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/07/Screenshot-2026-07-04-at-4.45.19---PM-53.png)

###