Types of Special Categories of Personal Data

Legal Framework

Article 9(1) GDPR establishes a general prohibition on processing eight enumerated categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation. Article 9(2) provides ten exemptions, but controllers must satisfy both an Article 6(1) lawful basis and a separate Article 9(2) derogation.

"Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited."
— GDPR Art. 9(1)

Two further articles create category-specific obligations. Article 22(4) restricts automated decisions involving special categories:

"Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place."
— GDPR Art. 22(4)

Article 37(1)(c) mandates a DPO where core activities involve large-scale processing of Article 9 data and Article 10 criminal-convictions data.

Key Developments

The CJEU has repeatedly reaffirmed the closed catalogue. In GC v CNIL, Meta Platforms v noyb, MK v K GmbH, Nemzeti v UC, Schrems v Meta, and ND v DR, the Court recited the full Article 9(1) enumeration before analysing which Article 9(2) exemption applies—confirming categorisation as the threshold inquiry.

Enforcement authorities treat the list as exhaustive:

"Art. 9 para. 2 GDPR contains a final list of exceptions to the processing prohibition according to para. 1"
— Austrian DSB, Private individual §3.3

The Irish DPC in Permanent TSB treated Articles 9 and 10 as distinct but related regimes, weighing special-category involvement as an aggravating factor in security-failure assessments. The EDPB has confirmed that controllers must identify both an Article 6(1) basis and an Article 9(2) derogation—explicit consent under 9(2)(a) can align with consent under 6(1)(a), but the assessments remain legally distinct.

Status of the Debate

This topic is actively contested in court. While the enumerated categories are textually fixed, their boundaries are not. Courts diverge on what constitutes data "revealing" racial or ethnic origin—particularly inferred or derived data. The scope of "biometric data for the purpose of uniquely identifying a natural person" remains unsettled where systems serve verification rather than identification. Member States may impose additional conditions on genetic, biometric, and health data under Article 9(4), producing cross-border fragmentation. The EDPB-EDPS Joint Opinion on the European Health Data Space flagged the tension between EU-level exemptions and national derogations as unresolved. CJEU clarification on inferred special-category data and the verification-versus-identification distinction would resolve the principal open questions.

Practical Guidance

• Map data to specific Article 9(1) categories: Document which enumerated category your processing touches, including inferred data that may "reveal" a protected characteristic.
• Secure dual legal bases: Establish both an Article 6(1) lawful basis and a separate Article 9(2) exemption for each processing purpose involving special categories.
• Check Member State conditions: For genetic, biometric, or health data, verify whether the relevant Member State has imposed additional limitations under Article 9(4).
• Trigger DPO assessment: Evaluate whether large-scale processing of Article 9 data forms part of core activities, mandating DPO designation under Article 37(1)(c).
• Restrict automated decisions: Ensure Article 22 automated decision-making does not rely on special categories unless Article 9(2)(a) or (g) applies, with suitable safeguards.