Health data is personal data relating to the physical or mental health of a natural person which reveals information about that person's health status. Under Article 4(15) of the General Data Protection Regulation (GDPR), this also includes information about the provision of healthcare services, insofar as it reveals information about a person's health status. Health data falls within the special categories of personal data under Article 9 GDPR and is therefore subject to stricter requirements for processing.
What constitutes health data under the GDPR?
Article 4(15) GDPR covers personal information from which details about a person's physical or mental health status can be derived.
This includes not only medical diagnoses and examination results, but also information about illnesses, disabilities, treatments and health conditions.
According to Recital 35 GDPR, the term includes information about a person's past, present and future health status.
Health data does not have to originate directly from a medical examination. Combining different pieces of information may also make it possible to draw conclusions about a person's health status. What matters is the content of the data and the context in which it is processed.
What types of information qualify as health data?
Health data includes, in particular:
- Medical diagnoses: Information about illnesses, injuries or health impairments.
- Examination and laboratory results: For example, blood test results, X-ray findings or the results of medical tests.
- Treatment information: Details of medical treatment, operations, therapies and prescribed medication.
- Information about disabilities: Details of physical or mental impairments and officially recognised degrees of disability.
- Mental health: Information about mental health conditions and psychotherapeutic treatment.
- Health-related measurements: For example, heart rate or blood glucose levels, insofar as they reveal information about a person's health status.
- Information about incapacity for work: Details of sickness-related absences or medical certificates confirming incapacity for work.
Information that does not initially appear to be medical in nature may also constitute health data if, in the specific context, it allows conclusions to be drawn about a person's health status.
By contrast, not every piece of information about physical activity or lifestyle is automatically health data. The decisive factor is what health-related information can be derived from it.
Under what conditions may health data be processed?
Under Article 9(1) GDPR, the processing of health data is generally prohibited. Processing is permitted only if an exception under Article 9(2) GDPR applies and an appropriate legal basis under Article 6 GDPR is also in place.
The main exceptions include:
- Explicit consent: Under Article 9(2)(a) GDPR, the data subject has explicitly consented to the processing of their health data for one or more specified purposes.
- Employment law and social protection: Under Article 9(2)(b) GDPR, processing is necessary, subject to the statutory conditions set out there, for the purposes of carrying out obligations or exercising specific rights.
- Protection of vital interests: Under Article 9(2)(c) GDPR, processing is necessary to protect vital interests where the data subject is physically or legally incapable of giving consent.
- Healthcare: Under Article 9(2)(h) GDPR, processing is necessary, subject to the statutory conditions, for purposes such as medical diagnosis, the provision of healthcare or treatment.
- Public health: Under Article 9(2)(i) GDPR, processing may be permitted on grounds of public interest in the area of public health, subject to the statutory conditions.
Further exceptions exist, for example, for certain scientific research purposes.
Where health data is processed for healthcare purposes under Article 9(2)(h) GDPR, the additional requirements of Article 9(3) GDPR must also be observed. Accordingly, processing must be carried out by or under the responsibility of a professional who is subject to an obligation of professional secrecy, or by another person who is also subject to an appropriate obligation of confidentiality.
Explicit consent is therefore not required in every case. The decisive factors are the applicable statutory conditions and the specific purpose of the processing.
The general data protection principles under Article 5 GDPR must also be observed. These include, in particular, purpose limitation, data minimisation, and integrity and confidentiality.
What specific safeguards apply to health data?
Given its sensitive nature, health data must be protected by appropriate technical and organisational measures. The requirements are determined in particular by Article 32 GDPR and the risks associated with the relevant processing.
Key safeguards include:
- Access restrictions: Health data may only be accessible to individuals who need it to perform their authorised duties.
- Encryption: Appropriate encryption methods can protect health data against unauthorised access when it is stored or transmitted.
- Access control policies: Controllers must specify which individuals are authorised to access particular health information.
- Confidentiality: Individuals with access to health data must comply with the applicable confidentiality requirements. In the medical sector, additional statutory duties of professional secrecy apply.
- Data erasure and retention policies: As a general rule, health data must not be stored for longer than is necessary for the relevant purposes, unless statutory retention obligations or other lawful grounds justify continued storage.
Under Article 25 GDPR, controllers must also take data protection by design and data protection-friendly default settings into account.
If processing is likely to result in a high risk to the rights and freedoms of natural persons, a Data Protection Impact Assessment must be carried out in advance under Article 35 GDPR. This may be particularly relevant for large-scale processing of sensitive health data.
What must employers consider when handling health data?
Health data is also processed in the employment context. This includes, for example, information about incapacity for work, health conditions or occupational medical examinations.
Employers may only collect and use such information where an appropriate legal basis under Article 6 GDPR and an applicable exception under Article 9(2) GDPR exist. The relevant employment law provisions must also be observed.
In the case of an ordinary notification of sickness, employers generally need information about the employee's incapacity for work and its expected duration, but not the specific medical diagnosis.
Special requirements apply to occupational medical examinations. Medical findings are generally subject to medical confidentiality. Employers therefore do not automatically have access to examination results or diagnoses.
A blanket consent declaration from employees does not justify every form of processing of their health data. Given the imbalance of power in the employment relationship, particular care must be taken when assessing whether consent has been given freely.
Practical example: Processing health data through a health app
A company offers a health app that allows users to record their heart rate, blood pressure readings and information about existing medical conditions.
Since this information makes it possible to draw conclusions about users' health status, it constitutes health data within the meaning of Article 4(15) GDPR.
The company intends to store and analyse the information in order to provide users with personalised health summaries.
The company requires an appropriate legal basis under Article 6 GDPR and an applicable exception under Article 9(2) GDPR to process the data. Explicit consent from users may be one option, provided that all statutory requirements are met.
The company provides users with transparent information about the purposes of processing, the legal bases, retention periods and all other required details. It also protects the health data through appropriate technical and organisational measures, for example by using encryption and restricting access rights.
legal data assessment: Health data is not processed exclusively in the medical sector. It may also be processed in employment relationships and in connection with digital services. Controllers should therefore assess at an early stage whether the information collected allows conclusions to be drawn about a person's health status. If it does, the specific requirements of Article 9 GDPR apply. The key considerations are an appropriate legal basis, limiting processing to the data necessary and maintaining a level of protection appropriate to the risk.
Legal bases
Article 4(15) GDPR; Articles 5 and 6 GDPR; Article 9 GDPR; Articles 25 and 32 GDPR; Article 35 GDPR; Recital 35 GDPR; Section 22 BDSG; Section 26 BDSG, insofar as applicable in a manner consistent with EU law.
Frequently asked questions about health data
Is health data a special category of personal data?
Yes. Under Article 9(1) GDPR, health data falls within the special categories of personal data. Its processing is generally prohibited unless a statutory exception applies and the other data protection requirements are met.
May health data be processed without consent?
Yes. Explicit consent is not always required. Processing may be permitted, for example, for medical treatment, certain employment law obligations or the protection of vital interests, provided that the statutory conditions are met.
Does fitness and health data collected through apps also qualify as health data?
Yes, insofar as the information collected allows conclusions to be drawn about a person's physical or mental health status. This may be the case, for example, with health measurements or information about medical conditions. However, not every general activity-related piece of information automatically qualifies as health data.
May an employer find out an employee's medical diagnosis?
As a general rule, an employer does not need to know the specific diagnosis when an employee reports sick. The standard electronic certificate of incapacity for work therefore does not disclose the diagnosis to the employer. Specific situations governed by law may require a different assessment.
How long may health data be stored?
There is no single retention period that applies in every case. The permissible retention period depends in particular on the purpose of processing and any statutory retention obligations. Once the purpose has ceased to apply and there is no other legal basis for continued storage, the data must generally be erased.
Related terms.
Biometric data Under Article 4(14) GDPR, biometric data are personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person. Where biometric data are processed for the purpose of uniquely identifying a person, the special protection requirements of Article 9 GDPR apply. Employee data protection Employee data protection governs the protection of employees' personal data in the employment relationship. Employers may only process employee data where a legal basis exists and the applicable data protection requirements are met. The key legal framework is the General Data Protection Regulation (GDPR), together with the European legal requirements governing the protection of employee data. Protected information includes, among other things, job application documents, salary data, health information and details of work performance. 