GDPR Article 9 starts with a prohibition on processing special categories of personal data. To proceed, a controller needs both an applicable exception under Article 9(2) and a lawful basis under Article 6. These are separate questions: a commercial reason to use information does not itself lift the Article 9 prohibition, while an Article 9 exception does not establish every other condition for lawful processing.
This guide explains how to identify the data, choose between the ten exceptions and document the limits of the resulting permission. It addresses the EU GDPR. National legislation can add conditions, and UK organisations must separately check the UK framework. Start with the Article 6 lawful bases when the underlying justification is uncertain.
What information falls within Article 9?
Article 9 covers personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It also covers genetic data, biometric data processed to uniquely identify someone, health data, and information concerning a person’s sex life or sexual orientation. Both physical and mental health are included. A diagnosis is not the only way information can reveal health: treatment history, test results or an assessment of future health risks can also do so.
Financial difficulties, a national identification number and a home address can be highly private without belonging to an Article 9 category. That distinction concerns the applicable legal provisions, not whether the information deserves protection. An address exposing someone’s location to an abusive former partner can create serious risks even though the address itself is ordinary personal data.
Look beyond column headings. An apparently ordinary dataset can reveal sensitive information through combination or inference. In its judgment of 1 August 2022 in Case C-184/20, the Court of Justice held that online publication of data liable indirectly to disclose sexual orientation falls within the special-category regime. Removing an explicit orientation field therefore does not necessarily remove Article 9 from the assessment.
A photograph is not automatically biometric special-category data. The relevant biometric condition involves specific technical processing and the purpose of unique identification. However, the same photograph may reveal another protected category in its context. The EDPB’s video guidance distinguishes ordinary footage from processing that deduces sensitive characteristics. Do not turn the biometric qualification into a blanket exemption for all images.
Pseudonymisation also leaves Article 9 relevant where people remain identifiable using additional information. Genuine anonymisation may take information outside the GDPR, but removing names alone does not establish it. Small groups, rare conditions and combinations of dates can make supposedly anonymous results identifiable. Evaluate the resulting dataset and likely access to other information before changing its classification.
Article 6 and Article 9 answer different questions
For each purpose, identify the applicable Article 6 basis and Article 9 exception together. A healthcare provider might have a legal duty or legally established public task alongside Article 9(2)(h). A voluntary health feature might use consent at both levels. A contract is an Article 6 basis only where processing is necessary for a contract with the individual, or relevant pre-contractual steps at their request; a supplier’s commercial agreement alone does not satisfy that test.
Legitimate interests is not categorically excluded as an Article 6 basis for special-category processing. It still requires a legitimate purpose, necessity and a balancing assessment, and it cannot itself supply an Article 9 exception. For example, processing strictly necessary to defend a legal claim may engage Article 9(2)(f), with Article 6(1)(f) assessed separately where available. Public authorities cannot use Article 6(1)(f) for processing in performance of their tasks.
The important distinction is between a missing Article 9 condition and an unsuitable Article 6 basis. If a recruitment platform wants to infer candidates’ health for commercial profiling, pointing to business interests does not solve the Article 9 problem. Conversely, describing a genuine legal dispute does not justify collecting every medical document held by an employee. Each permission is limited by necessity, purpose and the other GDPR principles.
The ten exceptions and their boundaries
Explicit consent: Article 9(2)(a)
The individual must expressly agree to the specified sensitive-data processing. Consent must also meet the ordinary requirements of freedom, specificity, information and an unambiguous choice. Union or Member State law may provide that the individual cannot lift the prohibition through consent. Check that restriction before designing a form; a signature cannot override it.
The EDPB’s final Guidelines 05/2020 on consent explain that a signed statement is one method, not a universal requirement. Paragraph 96 gives an online example with Yes and No checkboxes and an express consent statement. A carefully designed checkbox can therefore obtain explicit consent; a generic acknowledgement of a privacy notice cannot. See the Article 7 conditions and consent wording examples when implementing this route.
Employment and social protection: Article 9(2)(b)
Processing must be necessary for specific rights or obligations in employment, social security or social protection. It must be authorised by Union or Member State law, or a collective agreement under national law, with appropriate safeguards. An employer cannot use this exception merely because data concerns an employee. Identify the relevant duty, the information needed to fulfil it and the authorised recipients.
A sick-pay calculation may require evidence of absence without requiring a manager to read a detailed diagnosis. Occupational health and line management can have different information needs and legal responsibilities. Map those separately rather than treating an entire personnel file as one undifferentiated permission.
Vital interests: Article 9(2)©
This exception requires necessity to protect someone’s vital interests and that the data subject is physically or legally incapable of consenting. An unconscious person’s emergency care is a plausible example. Administrative convenience, a missed email or the possibility that someone might decline consent does not establish incapacity or a vital interest.
Certain non-profit activities: Article 9(2)(d)
The organisation must have a political, philosophical, religious or trade union aim and process within its legitimate activities with appropriate safeguards. The permitted population includes members, former members and people with regular contact connected to those purposes. It is not limited to current members, but neither is it an exception for every charity or every visitor. Disclosure outside the body requires the individuals’ consent under this condition.
Information manifestly made public: Article 9(2)(e)
The individual must have manifestly made the relevant data public. Public accessibility is insufficient by itself: a leaked spreadsheet, someone else’s post or an unintentionally exposed account does not establish that condition. Examine who disclosed the information, the context and the intended audience. Even where the exception applies, reuse still needs an Article 6 basis and compliance with fairness, transparency and purpose limitation.
Legal claims and judicial functions: Article 9(2)(f)
Processing may be necessary to establish, exercise or defend legal claims, or occur when courts act in their judicial capacity. This can be relevant to businesses and individuals as well as legal professionals. Record the connection between the material and the claim. Retaining a relevant medical assessment for a concrete dispute does not authorise maintaining unrelated health profiles in ordinary customer systems.
Substantial public interest: Article 9(2)(g)
This route requires Union or Member State law, proportionality, respect for the essence of data protection and suitable, specific safeguards. An organisation cannot create the exception by describing its own project as socially useful. Identify the authorising provision and its conditions, including any limits on the organisations or purposes it covers.
Health and social care: Article 9(2)(h)
The listed purposes include preventive or occupational medicine, assessment of working capacity, diagnosis, provision of health or social care or treatment, and management of the relevant systems and services. Processing must be grounded in Union or Member State law or a contract with a health professional, and satisfy Article 9(3)'s professional-secrecy conditions. A wellness label or the involvement of a health-themed application is insufficient. The health-data guide develops this distinction.
Public health: Article 9(2)(i)
This exception concerns necessity for public-interest purposes in public health, such as serious cross-border threats or standards of care and medical-product safety. Union or Member State law must provide suitable, specific safeguards, particularly professional secrecy. A private project’s beneficial health effects do not automatically make it a legally authorised public-health programme.
Archiving, research and statistics: Article 9(2)(j)
The exception covers necessary archiving in the public interest, scientific or historical research and statistical processing under Union or Member State law. That law must meet the proportionality, essential-rights and safeguard requirements, and Article 89(1) applies. Calling commercial analytics “research” does not supply the legal authorisation. Clarify the research purpose, access arrangements and safeguards before collecting identifiable sensitive information.
National rules require a separate check
Article 9(4) permits further national conditions, including limitations, for genetic, biometric and health data. National legislation is also relevant where an exception expressly requires a legal foundation. These are different routes and should not be conflated. A multinational organisation needs to identify the applicable national provisions for its specific processing rather than attach a generic country list to every record.
For example, section 26(3) of Germany’s BDSG addresses necessary employment-related special-category processing and includes conditions concerning the individual’s protected interests and safeguards. Its existence does not make every German employee survey lawful. This illustrates the need to read the operative conditions alongside the GDPR and relevant case law. For clinical operations, the healthcare compliance guide helps separate care, administration and optional secondary uses.
Consent to treatment, participation in a study and GDPR consent also perform different functions. A patient may agree to a procedure while the provider processes required records under another legal basis. Explain that distinction accurately; do not promise deletion of legally required clinical records simply because an individual changes their mind about an optional feature.
Build the decision into the data flow
Start with the decision the organisation needs to make. A hypothetical conference organiser accommodating dietary restrictions may need to tell a caterer which meals to provide, while having no reason to circulate medical explanations to the whole events team. Asking for an appropriate meal choice may reduce the sensitive information collected, although an allergy field can still reveal health. Apply data minimisation before choosing the exception.
Document the purpose, data categories, Article 6 basis, Article 9 condition, relevant national provision and evidence supporting necessity. A record saying only “sensitive data, consent” leaves the central questions unanswered. Link the assessment to the actual privacy information, consent version where relevant, access rules and retention decision. Article 30’s record fields and wider accountability evidence work together; every useful legal-analysis field is not thereby a literal Article 30 requirement.
Then check who receives the information and in what role. An IT provider processing on instructions requires the Article 28 arrangement: a written contract or another binding Union or Member State legal act, including electronic form. An independent professional deciding their own purposes may have a different role. Use a data processing agreement for genuine processing relationships and separately assess international transfers. An Article 9 condition does not authorise an overseas transfer by itself.
Security, risk assessment and automated decisions
Article 32 requires security appropriate to the risk. Encryption, access restrictions, logging and recovery arrangements may be necessary in a particular environment, but Article 9 does not impose a universal encryption specification. Consider both external attacks and ordinary internal misuse. A securely hosted medical file remains exposed if every employee can browse it. The Article 32 guide connects controls to the risks they address.
Large-scale processing of special-category data is an express DPIA trigger in Article 35(3)(b). Other processing may also require a DPIA when likely to create high risks; applicable Article 35 qualifications, including the statutory assessment situation in paragraph 10, require checking. A small dataset is therefore not an automatic exemption. Conduct the impact assessment before the processing, while design changes remain possible.
Article 22 adds conditions for decisions based solely on automated processing with legal or similarly significant effects. Under Article 22(4), such decisions cannot be based on special categories unless Article 9(2)(a) or (g) applies and suitable safeguards are in place. Satisfying another Article 9 exception for collecting data does not automatically permit this form of decision-making.
Withdrawal, deletion and accountability
If explicit consent is the Article 9 condition, provide a workable withdrawal route and stop the processing that depends on it after withdrawal. Withdrawal does not retroactively invalidate earlier lawful processing. It also cannot be defeated by silently substituting a new justification. Assess any genuinely separate duty to retain limited information under its own Article 6 and Article 9 conditions, explain it and restrict use accordingly.
Set retention around the purpose and applicable obligations. Evidence needed for a legal claim should be separated from routine operational access. An archive label does not justify indefinite storage, and a processor’s convenient backup schedule does not decide the controller’s retention policy. Verify that disposal or restriction reaches exports, analytics environments and supplier-held copies where relevant.
Failures can engage the higher administrative-fine tier under Article 83(5): up to €20 million or, for an undertaking, 4% of total worldwide annual turnover for the preceding financial year, whichever is higher. The actual sanction depends on the circumstances and statutory assessment; see the administrative fines framework. More immediately, an organisation may need to stop a processing activity whose business design assumed an unavailable exception.
Frequently asked questions
Can legitimate interests support processing health data?
It can potentially provide the Article 6 basis where its conditions are met and the basis is available. A separate Article 9 exception is still essential. Legitimate interests alone never removes the Article 9 prohibition, and sensitive-data risks are relevant to the balancing assessment.
Does explicit consent require a signature?
Not universally under the GDPR. It requires an express statement and all the other consent conditions. A clear online declaration can work; passive acceptance, a pre-ticked box or agreement merely to having read information cannot replace consent. Applicable national form requirements must also be checked.
Are criminal records an Article 9 category?
Criminal convictions, offences and related security measures are governed by Article 10. Processing under Article 6 must be under official-authority control or authorised by Union or Member State law with appropriate safeguards. A comprehensive convictions register must remain under official-authority control. This distinction matters in AML and screening processes; an employer’s preference for checks is not itself statutory authorisation.
The operative starting point is Regulation (EU) 2016/679, particularly Articles 5–10, 22, 28, 30, 32 and 35. Record a reasoned decision for the actual purpose, then make the operational limits match that decision.