Summarize this article with
Sensitive personal data (GDPR's "special category data") includes information like health status, religious belief, and racial or ethnic origin. Processing it requires both a standard Article 6 lawful basis and a separate Article 9(2) condition, not one or the other.
As companies collect more data across more touchpoints, the categories of information they handle keep expanding, and some of those categories carry a lot more legal weight than others. Most privacy programs are built around protecting personally identifiable information (PII).
Fewer are built with the same rigor around sensitive personal data, sometimes called sensitive personal information (SPI), even though GDPR treats it as a separate, higher-risk category with its own legal test.
Sensitive personal data is a category of personal data that reveals things like health status, racial or ethnic origin, religious belief, or sexual orientation, and that GDPR subjects to stricter processing rules than ordinary personal data.
Getting the legal basis wrong for this category is one of the more common (and more expensive) mistakes privacy teams make.
What is personal data?
Personal data is any information that can identify a specific individual, either on its own or combined with other data. Common examples include:
- Name
- Physical or online address
- Phone number
- IP address
- Biometric identifiers, such as fingerprints or retina scans
When personal data is exposed or misused, it can lead to identity theft, fraud, or other harm to the person it identifies.
What is sensitive personal data (special category data)?
Sensitive personal data is a subset of personal data that regulators single out for extra protection because of how damaging its misuse can be. GDPR calls this "special category data" and defines it in Article 9(1). Recital 51 explains the reasoning: this data needs a higher degree of protection because processing it could create significant risks to a person's fundamental rights and freedoms, including discrimination.
Special category data is harder to catch with standard data loss prevention tooling than obvious identifiers like a name or an email address, because it often shows up embedded in free text, survey responses, or inferred attributes rather than a labeled field.
GDPR special category data: examples
Article 9(1) lists the following as special categories of personal data:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data used to uniquely identify a person
- Health data
- Data concerning a person's sex life or sexual orientation
Quick reference: is it sensitive personal data?
The legal basis for processing sensitive personal data
This is the part organizations most often get wrong, so it's worth stating precisely: processing special category data under GDPR requires both a valid Article 6 lawful basis and a separate Article 9(2) condition. These two requirements are cumulative, not alternatives. Having one without the other doesn't clear the bar.
- Article 6 sets the general lawful bases that apply to all personal data processing: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
- Article 9(2) adds a second, narrower test that applies specifically to special category data. It lists limited conditions under which the Article 9(1) prohibition on processing special category data can be lifted, such as explicit consent, processing necessary for employment or social security law obligations, or processing necessary for reasons of substantial public interest.
An organization has to satisfy both articles at once. Explicit consent, for example, can serve as the Article 9(2) condition, but the organization still needs an Article 6 basis (typically consent again, or another applicable basis) to process the data at all.
Data controller vs. data processor: who's responsible for what
Handling sensitive personal data safely starts with knowing which role your organization plays, because GDPR assigns different obligations to each one.
What is a data controller?
A data controller is the organization that determines the purposes and means of processing personal data (GDPR Article 4(7)). The controller decides why data is collected and how it will be used, which makes it the party primarily accountable for GDPR compliance. Data controller responsibilities typically include:
- Deciding what types of data to collect and for what purpose.
- Setting retention timelines for stored data.
- Deciding how and with whom data will be shared.
- Establishing the lawful basis (and, where relevant, the Article 9(2) condition) for processing, and obtaining consent where required.
- Overseeing data protection impact assessments (DPIAs) for higher-risk processing.
What is a data processor?
A data processor is the organization that processes personal data on behalf of, and strictly according to the instructions of, a data controller (GDPR Article 4(8)). Processors don't decide why or how data is used; they carry out the controller's instructions, often under a data processing agreement required by Article 28. Data processor responsibilities typically include:
- Storing and safeguarding the personal data the controller provides.
- Applying the technical and organizational measures the controller requires.
- Recommending secure systems and practices that help the controller meet its collection and consent obligations.
- Transferring or returning data to the controller (or deleting it) at the end of the engagement, per the terms of the processing agreement.
Example: controller and processor in practice
Company A hires Company B to run its payroll, giving Company B access to employee salary and banking data strictly to process payroll on Company A's behalf. Company A is the controller: it decided to collect this data and why. Company B is the processor: it acts only within the instructions Company A sets.
