What is special category data under GDPR Article 9?

Article 9 is the part of the GDPR that turns "sensitive" from a feeling into a legal category. It names a specific list of data types and starts from the opposite of the usual position: instead of asking whether you have a lawful basis, it says you may not process this data at all, unless you fit one of a short set of exceptions. For a company that handles health, biometric, or similar data, Article 9 is often the rule that actually bites.

What counts as special category data?

Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It also covers genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person's sex life or sexual orientation. The wording "revealing" matters. Data does not have to state a health condition outright to fall in scope; if it lets you infer one, it can still be special category data. That is why an app tracking symptoms, or an audience segment built around a religious interest, can land inside Article 9 without anyone labelling it as sensitive.

Why the article starts with a prohibition

Most GDPR processing is allowed once you have an Article 6 lawful basis. Article 9 flips that default. Processing special categories is banned unless one of the Article 9(2) conditions applies, so the burden is on you to find and record a specific gateway before you touch the data. Biometric data is the trap many product teams miss: it becomes special category data only when you use it to uniquely identify someone, so face recognition and fingerprint matching are in scope, while an ordinary photo you are not matching is not.

The Article 9(2) exceptions

Article 9(2) lists the ways out of the prohibition. The ones a business is most likely to use are explicit consent from the data subject; processing necessary for obligations in the field of employment and social security law; data that the data subject has manifestly made public; processing necessary for the establishment, exercise or defence of legal claims; and processing for health or social care by or under the responsibility of a professional bound by secrecy. Others cover vital interests, not-for-profit bodies, substantial public interest, public health, and archiving or research. Whichever you rely on, name it and document it before you process.

How Article 9 works with Article 6

Article 9 does not replace your Article 6 lawful basis; it stacks on top of it. You need both: a lawful basis under Article 6 and a condition under Article 9(2). This is also why legitimate interests cannot carry sensitive data on its own, and why explicit consent under Article 7 is often the practical route. Getting this wrong is a high-tier infringement that sits in the upper fining band, which is where how GDPR fines are calculated explains the exposure.

The Article 9(1) list, verbatim

The prohibition in Article 9(1) covers processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Article 9(2) then lists ten conditions, running from (a) explicit consent through (j) archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1). Article 9(3) restricts the health-care condition in point (h) to processing by or under the responsibility of a professional subject to an obligation of professional secrecy, and Article 9(4) lets Member States keep or introduce further conditions, including limitations, for genetic, biometric, or health data.

Next step

If you process anything that could reveal health, biometrics, or the other special categories, the free 2-minute Obligation Scan checks whether the GDPR reaches you and flags where you need an Article 9(2) condition on top of your Article 6 basis, so sensitive data does not move without a gateway. The GDPR compliance hub sets the rest of your obligations in order.