GDPR Q33
What are special category data?
Q33. What are special category data?
Category: Sensitive Data
Special category data is highly sensitive information that receives extra protection under GDPR.
In simple terms
- Covers areas like health, biometrics, race, religion, and sexual orientation.
- Requires both a lawful basis under Article 6 and a special category condition under Article 9.
- Needs stronger security and accountability measures.
Identifying special category data
Article 9 lists the categories. Treat anything revealing these traits as special category data, even if the person shared it voluntarily.
- Includes genetic and biometric data used for uniquely identifying someone.
- Criminal conviction data is covered separately under Article 10 but still requires safeguards.
- Political opinions, trade union membership, and philosophical beliefs also qualify.
Conditions for processing
Choose an Article 9 condition such as explicit consent, employment law obligations, vital interests, or public interest.
- Document the condition and supporting evidence.
- Consider DPIAs and additional safeguards like encryption and access controls.
- Keep records of who accessed the data and why.
Practical steps to take
- Flag special category data in your systems and registers.
- Confirm both an Article 6 lawful basis and an Article 9 condition.
- Restrict access to authorised personnel only.
- Implement stronger security measures, including encryption and audit trails.
- Review retention periods and delete data when no longer needed.
Real-life examples
Health records
A clinic stores patient health data securely, restricts access to clinicians, and relies on legal obligation and healthcare provision conditions.
Equality monitoring
An employer collects diversity statistics with explicit consent and stores data separately with limited access.
Helpful reminders
- Obtain explicit consent in writing when relying on that condition.
- Ensure third-party processors can meet higher security expectations.
- Keep documentation for regulatory inspections.
Key takeaway
Handle special category data with extreme care—pair the right legal conditions with robust security and clear accountability.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.