Art. 9 GDPR · Chapter II: Principles
Article 9 GDPR: Processing of special categories of personal data
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Processing of special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic, biometric or health data, and data on sex life or sexual orientation) is prohibited unless one of the exceptions in paragraph 2 applies. Member States may keep or introduce further conditions for genetic, biometric or health data.
Official text
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
Paragraph 1 shall not apply if one of the following applies:
the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
processing relates to personal data which are manifestly made public by the data subject;
processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others
Judgment of 14 July 2026ECLI:EU:C:2026:579
Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers.
- C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL
Judgment of 2 December 2025ECLI:EU:C:2025:935
An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.
- C-65/23, MK v K GmbH
Judgment of 19 December 2024ECLI:EU:C:2024:1051
Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary.
- C-446/21, Maximilian Schrems v Meta Platforms Ireland Limited
Judgment of 4 October 2024ECLI:EU:C:2024:834
Data minimisation prevents a social network from using all personal data it collects, on or off the platform, for targeted advertising without limits of time or type; a person who speaks publicly about their sexual orientation does not thereby allow the network to process other data about it for advertising.
- C-21/23, ND v DR
Judgment of 4 October 2024ECLI:EU:C:2024:846
Competitors may sue under unfair-competition law for GDPR breaches; order data entered to buy pharmacy-only medicines online are health data even without a prescription.
- C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts
Judgment of 21 December 2023ECLI:EU:C:2023:1022
A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault.
- C-252/21, Meta Platforms Inc and Others v Bundeskartellamt
Judgment of 4 July 2023ECLI:EU:C:2023:537
A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given.
- C-184/20, OT v Vyriausioji tarnybinės etikos komisija
Judgment of 1 August 2022ECLI:EU:C:2022:601
Publishing online the declarations of interests of public officials, including names of spouses and partners, is disproportionate; data that can indirectly reveal sexual orientation are special-category data.
Related (earlier law or other instruments)
- C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:773
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them.
EDPB guidance
- Guidelines 3/2025 on the interplay between the DSA and the GDPR
EDPB 03/2025FinalFirst published 12 September 2025Final version 17 September 2026
Version 2 is final.
- Guidelines 1/2026 on processing of personal data for scientific research purposes
EDPB 01/2026Draft for consultationFirst published 16 April 2026
Consultation closed 25 June 2026; final version not yet published.
- Guidelines 02/2021 on virtual voice assistants
EDPB 02/2021FinalFirst published 12 March 2021Final version 7 July 2021
- Guidelines 8/2020 on the targeting of social media users
EDPB 08/2020FinalFirst published 7 September 2020Final version 13 April 2021
- Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
EDPB 01/2020FinalFirst published 7 February 2020Final version 9 March 2021
Final version 2.0.
- Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR
EDPB 06/2020FinalFirst published 22 July 2020Final version 15 December 2020
- Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak
EDPB 03/2020FinalFirst published 21 April 2020Final version 21 April 2020
Pandemic-specific; may be overtaken by Guidelines 1/2026 when final.
- Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak
EDPB 04/2020FinalFirst published 21 April 2020Final version 21 April 2020
Pandemic-specific.
- Guidelines 3/2019 on processing of personal data through video devices
EDPB 03/2019FinalFirst published 12 July 2019Final version 30 January 2020
Fines
Amounts are shown in the currency in which the fine was imposed.
- Xandr Inc.: NOK 92,000,000
Datatilsynet (Norwegian Data Protection Authority), NorwayDecision of 2 October 2026Appeal status: unknown
As an ad exchange in real-time bidding, processed Grindr users' data (revealing sexual orientation) without a legal basis, relying on Grindr's invalid consents.
- IQVIA Solutions Italy S.r.l: EUR 7,000,000
Garante per la protezione dei dati personali, ItalyDecision of 23 September 2026Appeal status: unknown
Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security.
- Foodinho s.r.l.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 13 November 2024Appeal status: unknown
Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.
- Clearview AI Inc.: EUR 30,500,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 May 2024Appeal status: not appealed
Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.
- EOS Matrix d.o.o.: EUR 5,470,000
Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), CroatiaAnnounced on 5 October 2023Appeal status: unknown
Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.
- Clearview AI, Inc: EUR 20,000,000
Hellenic Data Protection Authority, GreeceDecision of 13 July 2022Appeal status: unknown
Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.
- Clearview AI: EUR 20,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 February 2022Appeal status: unknown
Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.
- Grindr LLC: NOK 65,000,000
Datatilsynet (Norwegian Data Protection Authority), NorwayDecision of 13 December 2021Appeal status: upheld
Shared users' data (including the fact of using a gay dating app) with advertising partners without valid consent.
- Google LLC: SEK 75,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 10 March 2020Appeal status: reduced
Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.
- Post AG: EUR 18,000,000
Datenschutzbehörde (Austrian Data Protection Authority), AustriaDecision of 23 October 2019Appeal status: reduced
Calculated and stored 'party affinity' scores (likely political leanings) for about 2.2 million people and sold some, without consent; also reused parcel data for marketing.
Not fully confirmed: The DSB page does not name the company; the name comes from the Federal Administrative Court's own news page (bvwg.gv.at, 3 Dec 2020). History: annulled 2020 on a procedural point, reinstated on further appeal, cut to EUR 16m (27 Dec 2024), finally set at EUR 13m by the Supreme Administrative Court on 24 Jun 2026.