---
title: "Art. 9 GDPR: Processing of special categories of personal data"
canonical: "https://dposchool.com/gdpr/article/9"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_9"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 9 GDPR · Chapter II: Principles

# Article 9 GDPR: Processing of special categories of personal data

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

Processing of special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic, biometric or health data, and data on sex life or sexual orientation) is prohibited unless one of the exceptions in paragraph 2 applies. Member States may keep or introduce further conditions for genetic, biometric or health data.

## Official text

### Article 9(1)

**1.** Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

### Article 9(2)

**2.** Paragraph 1 shall not apply if one of the following applies:

#### Article 9(2)(a)

**(a)** the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

#### Article 9(2)(b)

**(b)** processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

#### Article 9(2)(c)

**(c)** processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

#### Article 9(2)(d)

**(d)** processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;

#### Article 9(2)(e)

**(e)** processing relates to personal data which are manifestly made public by the data subject;

#### Article 9(2)(f)

**(f)** processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

#### Article 9(2)(g)

**(g)** processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

#### Article 9(2)(h)

**(h)** processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

#### Article 9(2)(i)

**(i)** processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

#### Article 9(2)(j)

**(j)** processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

### Article 9(3)

**3.** Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

### Article 9(4)

**4.** Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 9 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_9)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 51](https://dposchool.com/gdpr/recital/51)
- [Recital 52](https://dposchool.com/gdpr/recital/52)
- [Recital 53](https://dposchool.com/gdpr/recital/53)
- [Recital 54](https://dposchool.com/gdpr/recital/54)

## Court of Justice judgments

### [C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others](https://dposchool.com/gdpr/case/c-474-24)

Judgment of 14 July 2026 · ECLI:EU:C:2026:579

Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-474/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0474)

### [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23)

Judgment of 2 December 2025 · ECLI:EU:C:2025:935

An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492)

### [C-65/23, MK v K GmbH](https://dposchool.com/gdpr/case/c-65-23)

Judgment of 19 December 2024 · ECLI:EU:C:2024:1051

Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-65/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065)

### [C-446/21, Maximilian Schrems v Meta Platforms Ireland Limited](https://dposchool.com/gdpr/case/c-446-21)

Judgment of 4 October 2024 · ECLI:EU:C:2024:834

Data minimisation prevents a social network from using all personal data it collects, on or off the platform, for targeted advertising without limits of time or type; a person who speaks publicly about their sexual orientation does not thereby allow the network to process other data about it for advertising.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-446/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0446)

### [C-21/23, ND v DR](https://dposchool.com/gdpr/case/c-21-23)

Judgment of 4 October 2024 · ECLI:EU:C:2024:846

Competitors may sue under unfair-competition law for GDPR breaches; order data entered to buy pharmacy-only medicines online are health data even without a prescription.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-21/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0021)

### [C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts](https://dposchool.com/gdpr/case/c-667-21)

Judgment of 21 December 2023 · ECLI:EU:C:2023:1022

A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-667/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0667)

### [C-252/21, Meta Platforms Inc and Others v Bundeskartellamt](https://dposchool.com/gdpr/case/c-252-21)

Judgment of 4 July 2023 · ECLI:EU:C:2023:537

A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-252/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252)

### [C-184/20, OT v Vyriausioji tarnybinės etikos komisija](https://dposchool.com/gdpr/case/c-184-20)

Judgment of 1 August 2022 · ECLI:EU:C:2022:601

Publishing online the declarations of interests of public officials, including names of spouses and partners, is disproportionate; data that can indirectly reveal sexual orientation are special-category data.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-184/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184)

### Related (earlier law or other instruments)

#### [C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-136-17)

Judgment of 24 September 2019 · ECLI:EU:C:2019:773

Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)

The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-136/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0136)

## EDPB guidance

### [Guidelines 3/2025 on the interplay between the DSA and the GDPR](https://dposchool.com/gdpr/guidance/edpb-03-2025)

EDPB 03/2025 · Final · First published 12 September 2025 · Final version 17 September 2026

Version 2 is final.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en)

### [Guidelines 1/2026 on processing of personal data for scientific research purposes](https://dposchool.com/gdpr/guidance/edpb-01-2026)

EDPB 01/2026 · Draft for consultation · First published 16 April 2026

Consultation closed 25 June 2026; final version not yet published.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en)

### [Guidelines 02/2021 on virtual voice assistants](https://dposchool.com/gdpr/guidance/edpb-02-2021)

EDPB 02/2021 · Final · First published 12 March 2021 · Final version 7 July 2021

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022021-on-virtual-voice-assistants_en)

### [Guidelines 8/2020 on the targeting of social media users](https://dposchool.com/gdpr/guidance/edpb-08-2020)

EDPB 08/2020 · Final · First published 7 September 2020 · Final version 13 April 2021

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en)

### [Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications](https://dposchool.com/gdpr/guidance/edpb-01-2020)

EDPB 01/2020 · Final · First published 7 February 2020 · Final version 9 March 2021

Final version 2.0.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012020-on-processing-personal-data-in-the-context-of-connected_en)

### [Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR](https://dposchool.com/gdpr/guidance/edpb-06-2020)

EDPB 06/2020 · Final · First published 22 July 2020 · Final version 15 December 2020

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-062020-on-the-interplay-of-the-second-payment-services-directive-and_en)

### [Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak](https://dposchool.com/gdpr/guidance/edpb-03-2020)

EDPB 03/2020 · Final · First published 21 April 2020 · Final version 21 April 2020

Pandemic-specific; may be overtaken by Guidelines 1/2026 when final.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032020-on-the-processing-of-data-concerning-health-for-the-purpose_en)

### [Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak](https://dposchool.com/gdpr/guidance/edpb-04-2020)

EDPB 04/2020 · Final · First published 21 April 2020 · Final version 21 April 2020

Pandemic-specific.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042020-on-the-use-of-location-data-and-contact-tracing-tools-in-the_en)

### [Guidelines 3/2019 on processing of personal data through video devices](https://dposchool.com/gdpr/guidance/edpb-03-2019)

EDPB 03/2019 · Final · First published 12 July 2019 · Final version 30 January 2020

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32019-on-processing-of-personal-data-through-video-devices_en)

## Fines

Amounts are shown in the currency in which the fine was imposed.

### [Xandr Inc.: NOK 92,000,000](https://dposchool.com/gdpr/fine/dt-xandr-2026-10)

Datatilsynet (Norwegian Data Protection Authority), Norway · Decision of 2 October 2026 · Appeal status: unknown

As an ad exchange in real-time bidding, processed Grindr users' data (revealing sexual orientation) without a legal basis, relying on Grindr's invalid consents.

[Source: the authority](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/)

### [IQVIA Solutions Italy S.r.l: EUR 7,000,000](https://dposchool.com/gdpr/fine/garante-iqvia-2026-09)

Garante per la protezione dei dati personali, Italy · Decision of 23 September 2026 · Appeal status: unknown

Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security.

[Source: the authority](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en)

### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11)

Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown

Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601)

### [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 May 2024 · Appeal status: not appealed

Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai)

### [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10)

Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Croatia · Announced on 5 October 2023 · Appeal status: unknown

Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.

[Source: the authority](https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/)

### [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07)

Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown

Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.

[Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc)

### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02)

Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown

Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362)

### [Grindr LLC: NOK 65,000,000](https://dposchool.com/gdpr/fine/dt-grindr-2021-12)

Datatilsynet (Norwegian Data Protection Authority), Norway · Decision of 13 December 2021 · Appeal status: upheld

Shared users' data (including the fact of using a gay dating app) with advertising partners without valid consent.

[Source: the authority](https://www.datatilsynet.no/en/regulations-and-tools/regulations/avgjorelser-fra-datatilsynet/2021/gebyr-til-grindr/)

### [Google LLC: SEK 75,000,000](https://dposchool.com/gdpr/fine/imy-google-2020-03)

Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 10 March 2020 · Appeal status: reduced

Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.

[Source: the authority](https://www.imy.se/tillsyner/google/)

### [Post AG: EUR 18,000,000](https://dposchool.com/gdpr/fine/dsb-post-2019-10)

Datenschutzbehörde (Austrian Data Protection Authority), Austria · Decision of 23 October 2019 · Appeal status: reduced

Calculated and stored 'party affinity' scores (likely political leanings) for about 2.2 million people and sold some, without consent; also reused parcel data for marketing.

Not fully confirmed: The DSB page does not name the company; the name comes from the Federal Administrative Court's own news page (bvwg.gv.at, 3 Dec 2020). History: annulled 2020 on a procedural point, reinstated on further appeal, cut to EUR 16m (27 Dec 2024), finally set at EUR 13m by the Supreme Administrative Court on 24 Jun 2026.

[Source: the authority](https://dsb.gv.at/aktuelles/vwgh-bestaetigt-unrechtmaessige-verarbeitung-von-partei-affinitaeten-und-setzt-geldbusse-mit-eur-13-mio-fest)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter II](https://dposchool.com/gdpr/chapter/2) / Article 9

Previous: [Art. 8 GDPR: Conditions applicable to child's consent in relation to information society services](https://dposchool.com/gdpr/article/8)

Next: [Art. 10 GDPR: Processing of personal data relating to criminal convictions and offences](https://dposchool.com/gdpr/article/10)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents