Special Category Data (GDPR Article 9)

GDPR Article 9 special category data is the subset of personal data the regulation treats as inherently sensitive enough to require its own, additional lawful ground before processing can happen at all — on top of, not instead of, an ordinary Article 6 basis. Most human-participant research (health studies, genetic cohorts, biometric identification, studies touching political or religious affiliation) processes at least one special category, which is why Article 9 sits at the centre of GDPR compliance planning for research data.

The nine categories under Article 9(1)

Article 9(1) prohibits processing of personal data revealing or concerning:

1. Racial or ethnic origin
2. Political opinions
3. Religious or philosophical beliefs
4. Trade union membership
5. Genetic data
6. Biometric data, where used for the purpose of uniquely identifying a natural person
7. Data concerning health
8. Data concerning a natural person’s sex life
9. Data concerning a natural person’s sexual orientation

The prohibition is the default position. Article 6 alone — consent, legitimate interests, a task in the public interest, and so on — is not sufficient on its own to process any of these categories; a separate Article 9(2) condition is also required before the processing is lawful.

The research derogation: Article 9(2)(j)

Article 9(2) lists ten conditions that lift the Article 9(1) prohibition (explicit consent, employment and social-security-law obligations, vital interests, not-for-profit-body processing of members’ data, data manifestly made public by the data subject, legal claims, substantial public interest, health or social care, public health, and research). The condition most research controllers rely on is Article 9(2)(j), which permits processing that is:

“necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.”

Two things make 9(2)(j) narrower than it first appears. First, it is not self-executing: it requires an underlying Union or Member State law, so a research controller cannot simply assert “this is scientific research” and proceed — there has to be a real domestic legal basis behind it. In the UK, that basis is the Data Protection Act 2018, Schedule 1, Part 1, condition 4, which additionally requires a documented “appropriate policy document.” EU member states have their own implementing provisions, and they are not identical, which matters for multi-country studies that need to check the basis per site rather than assume it is harmonised. Second, 9(2)(j) is explicitly tied back to Article 89(1), which requires “appropriate safeguards” — technical and organisational measures, with pseudonymisation named specifically — for any processing that relies on the research derogation, whether under Article 9(2)(j) or the related Article 5(1)(b) and Article 6(1)(e)/(f) research provisions.

Relationship to consent

Explicit consent (Article 9(2)(a)) is a separate, independent route into special category processing and does not require the Article 89(1) safeguards regime the same way 9(2)(j) does — but consent has to be genuinely explicit, freely given, specific, and revocable, which is a demanding standard for long-running or repurposed research data. Many research governance frameworks favour 9(2)(j) precisely because consent alone is fragile for cohort studies, biobanks, or secondary-use data where re-contacting every participant for a new, specific consent is impractical.

What is not special category data

Article 9 is a closed, specifically enumerated list — it does not extend to every category of data a researcher might informally think of as “sensitive.” Financial data, criminal-offence data (governed separately, under Article 10), and most demographic identifiers outside the nine categories above are ordinary personal data under Article 6, not Article 9. Fully anonymised data, from which no individual can be re-identified by any means reasonably likely to be used, falls outside GDPR entirely (Recital 26) and is not special category data because it is not personal data at all; pseudonymised data, by contrast, remains personal data and, if it falls into one of the nine categories, remains special category data.

Practical implications for research data management

Identifying that a dataset contains Article 9 special category data early — at the data management plan stage, not after collection — determines what else is required downstream: a documented Article 89(1) safeguards plan, likely a Data Protection Impact Assessment under Article 35 (special category processing is one of the criteria that commonly triggers the DPIA threshold), a defined retention and deletion schedule, and role-clear documentation of who is controller and who is processor for the sensitive elements specifically, since these obligations attach to the data, not to the study as a whole.