GDPR Article 9: biometric data and the special categories of personal data

Article 9 is the part of the GDPR that turns "sensitive" from a feeling into a legal category. It names a specific list of data types and starts from the opposite of the usual position: instead of asking whether you have a lawful basis, it says you may not process this data at all, unless you fit one of a short set of exceptions. For a company that handles health, biometric, or similar data, Article 9 is often the rule that actually bites.

What counts as special category data?

Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It also covers genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person's sex life or sexual orientation. The wording "revealing" matters. Data does not have to state a health condition outright to fall in scope; if it lets you infer one, it can still be special category data. That is why an app tracking symptoms, or an audience segment built around a religious interest, can land inside Article 9 without anyone labelling it as sensitive.

Why the article starts with a prohibition

Most GDPR processing is allowed once you have an Article 6 lawful basis. Article 9 flips that default. Processing special categories is banned unless one of the Article 9(2) conditions applies, so the burden is on you to find and record a specific gateway before you touch the data. Biometric data is the trap many product teams miss: it becomes special category data only when you use it to uniquely identify someone, so face recognition and fingerprint matching are in scope, while an ordinary photo you are not matching is not.

The Article 9(2) exceptions

Article 9(2) lists the ways out of the prohibition. The ones a business is most likely to use are explicit consent from the data subject; processing necessary for obligations in the field of employment and social security law; data that the data subject has manifestly made public; processing necessary for the establishment, exercise or defence of legal claims; and processing for health or social care by or under the responsibility of a professional bound by secrecy. Others cover vital interests, not-for-profit bodies, substantial public interest, public health, and archiving or research. Whichever you rely on, name it and document it before you process.

How Article 9 works with Article 6

Article 9 does not replace your Article 6 lawful basis; it stacks on top of it. You need both: a lawful basis under Article 6 and a condition under Article 9(2). This is also why legitimate interests cannot carry sensitive data on its own, and why explicit consent under Article 7 is often the practical route. Getting this wrong is a high-tier infringement that sits in the upper fining band, which is where how GDPR fines are calculated explains the exposure.

The Article 9(1) list, verbatim

The prohibition in Article 9(1) covers processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Article 9(2) then lists ten conditions, running from (a) explicit consent through (j) archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1); each is quoted in full below. Article 9(3) restricts the health-care condition in point (h) to processing by or under the responsibility of a professional subject to an obligation of professional secrecy, and Article 9(4) lets Member States keep or introduce further conditions, including limitations, for genetic, biometric, or health data.

The Article 9(2) conditions, verbatim

Article 9(2) opens "Paragraph 1 shall not apply if one of the following applies", then runs to point (j). The conditions that most often carry commercial processing are these.

Point (a): "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject".

Point (b): processing necessary for carrying out the obligations and exercising specific rights of the controller or the data subject in the field of employment and social security and social protection law.

Point (c): processing necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent.

Point (d): processing carried out in the course of its legitimate activities by a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, on condition that the processing relates solely to members, former members or persons who have regular contact with it in connection with its purposes, and that the data are not disclosed outside that body without the consent of the data subjects.

Point (e): "processing relates to personal data which are manifestly made public by the data subject".

Point (f): "processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity".

Point (g): processing necessary for reasons of substantial public interest, on the basis of Union or Member State law which is proportionate to the aim pursued, respects the essence of the right to data protection and provides suitable and specific safeguards.

Point (h): processing necessary for preventive or occupational medicine, assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services, on the basis of Union or Member State law or pursuant to contract with a health professional, subject to the conditions and safeguards in paragraph 3.

Point (i): processing necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law providing suitable and specific safeguards, in particular professional secrecy.

Point (j): processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), based on Union or Member State law that is proportionate to the aim pursued and respects the essence of the right to data protection.

Two gates sit behind the list. Article 9(3) restricts point (h) to processing by or under the responsibility of a professional subject to an obligation of professional secrecy under Union or Member State law or rules established by national competent bodies, or by another person also subject to such an obligation. Article 9(4) states that "Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health", which is why biometric processing can be lawful under the Regulation and still be restricted by national law.

For a commercial product, points (a), (b) and (f) are usually the only realistic routes. Explicit consent is a higher standard than ordinary consent and has to be a clear affirmative statement covering the specific special-category processing, not a general tickbox.

Next step

If you process anything that could reveal health, biometrics, or the other special categories, the free 2-minute Obligation Scan checks whether the GDPR reaches you and flags where you need an Article 9(2) condition on top of your Article 6 basis, so sensitive data does not move without a gateway. The GDPR compliance hub sets the rest of your obligations in order.