Overview

This article restricts the processing of special categories of personal data, including racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic, biometric, health, or sexual orientation data. Processing is generally prohibited unless specific legal conditions are met, such as explicit consent, compliance with legal obligations, protection of vital interests, or performance of tasks in the public interest, accompanied by appropriate safeguards.


Key Principles

  • Prohibition by Default: Special categories of personal data cannot be processed unless a lawful exception applies.

  • Explicit Consent: Where applicable, consent must be freely given, specific, informed, and unambiguous.

  • Safeguards: Technical and organizational measures must be applied to protect sensitive data.

  • Legal Exceptions: Processing is allowed when necessary for legal obligations, vital interests, public interest tasks, or employment/social security purposes.

Organizational Applicability

This article applies to all organizations that process special categories of personal data within the EU:

  • Organizations handling sensitive personal data of EU/EEA data subjects.

  • Public and private sector entities acting as controllers or processors.

  • Teams responsible for HR, health, biometric systems, or other sensitive data processing activities.

Implementation Requirements

  • Identify all processing activities involving special categories of personal data.

  • Determine and document the lawful basis or exception for processing.

  • Implement safeguards such as encryption, pseudonymisation, and access controls.

  • Maintain records demonstrating compliance with GDPR Article 9 provisions.

Implementation Guidance

  • Conduct a data classification exercise to identify special categories of personal data.

  • Apply explicit consent collection mechanisms where required.

  • Ensure processing activities are limited to authorized personnel only.

  • Regularly review processing activities and safeguards to maintain compliance.

Periodic Review

  • Frequency: Annually or when new sensitive data is collected or processing methods change.

  • Responsible Role: Data Protection Officer (DPO) or Compliance Team.

  • Outcome: Confirm all processing of special categories is lawful, documented, and safeguarded.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover.

  • Legal Exposure: Enforcement actions, lawsuits, and data subject complaints.

  • Reputational Damage: Loss of trust from data subjects, partners, and regulators.

  • Operational Risk: Inability to process sensitive data without valid legal basis or safeguards.