Special categories of personal data are particularly sensitive information whose processing is prohibited in principle under Art. 9 GDPR and permitted only by way of exception.
Which data is included?
Art. 9(1) GDPR contains an exhaustive list:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data for the purpose of uniquely identifying a person
- data concerning health
- data concerning a person's sex life or sexual orientation
Data relating to criminal convictions and offences is not a special category, but Art. 10 GDPR also subjects it to its own rules.
When is processing permitted?
In addition to a legal basis under Art. 6 GDPR, an exception under Art. 9(2) GDPR is required, for example explicit consent, obligations under employment and social security law or purposes of preventive medicine. Section 22 BDSG applies in addition.
Processing such data on a large scale regularly triggers further obligations, such as a data protection impact assessment or the designation of a data protection officer.
Legal provisions
- Art. 9 GDPR
- Prohibition of processing and exhaustive list of exceptions.
- Section 22 BDSG
- National grounds for permitted processing and safeguards.
- Art. 35(3)(b) GDPR
- Data protection impact assessment for large-scale processing.
Related terms.
Biometric data Biometric data is data resulting from specific technical processing relating to physical, physiological or behavioural characteristics which allows or confirms the unique identification of a person. Art. 4(14) GDPR Personal data Personal data means any information relating to an identified or identifiable natural person. Art. 4(1) GDPR Data protection impact assessment (DPIA) The data protection impact assessment is a structured risk analysis for processing operations that are likely to result in a high risk to data subjects. Art. 35 GDPR 