Special category data is personal data that GDPR treats as especially sensitive, such as health, genetic or biometric data. Article 9 GDPR starts from a ban: processing these categories is prohibited unless one of a short list of exceptions applies, such as explicit consent or the provision of health care. The idea is simple: misuse of this data can lead to discrimination, exclusion or serious harm, so the bar is higher.
An everyday example
A mid-sized logistics company, "Example Freight Ltd" (a made-up example), handles plenty of ordinary personal data: names, addresses, bank details. But its HR team also holds sick notes, a few disability records for workplace adjustments, and union membership for payroll deductions. Its new access system uses fingerprints.
Those four things, sick notes, disability, union membership, fingerprints, are special category data. The rest of the HR file is "normal" personal data. The company needs a legal basis under Art. 6 for everything, and on top of that an Art. 9 exception for the special categories.
The details, simply
The special categories (Art. 9(1))
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data used to uniquely identify a person (fingerprints, face templates)
- Health data
- Data about a person's sex life or sexual orientation
Criminal convictions and offences are handled separately, under Art. 10.
What counts as health data
GDPR defines health data broadly (Art. 4(15)): any personal data about a person's physical or mental health, including the provision of health care, that reveals information about their health status. That covers diagnoses and lab results, but also appointment bookings at a specialist, prescriptions, sick notes, therapy session notes and fitness data that reveals a condition.
The exceptions (Art. 9(2))
Processing is allowed only if one of these applies, among others:
- Explicit consent from the person, for one or more specified purposes.
- Employment and social security law obligations.
- Vital interests, where the person cannot consent (a medical emergency).
- Data the person has manifestly made public.
- Legal claims, establishing or defending them in court.
- Substantial public interest, based on law.
- Health and social care: preventive or occupational medicine, diagnosis, treatment and management of care, by or under the responsibility of a professional bound by secrecy (Art. 9(2)(h) and 9(3)).
- Public health, for example protecting against serious cross-border threats.
- Archiving, research and statistics, with safeguards.
Member states may add further conditions for genetic, biometric and health data.
Extra duties
High-risk processing of special category data on a large scale usually requires a data protection impact assessment (Art. 35(3)(b)). Breaking the Art. 9 rules falls in GDPR's higher fine tier: up to €20 million or 4% of worldwide annual turnover, whichever is higher.
This is general information, not legal advice.
What it does not protect
Article 9 is one of the strictest rules in GDPR. But it shares GDPR's boundary: it only protects data that relates to an identifiable person. Recital 26 states that data protection does not apply to anonymous information.
That means:
- Health data with the names removed in a way that counts as anonymised is no longer special category data. It is no longer personal data at all.
- At that point the strict Art. 9 ban falls away, and the data can legally be pooled, licensed and sold. De-identified health records are a traded commodity, used by data brokers, analytics firms, insurers and AI developers.
- Pseudonymised health data is still special category data. Calling a dataset "anonymous" does not make it so: in 2026, France's CNIL fined a health-data company €5 million in a case where the company argued its prescription data was anonymous and the CNIL found it was only pseudonymised.
- Health data re-identifies easily. A rare diagnosis plus an age and a postcode can point to one person. See pseudonymisation vs anonymisation for the research.
The most sensitive data under GDPR is also, once anonymised, among the most valuable to buyers. We show how a single record travels on the data trail and why each step is lawful on legal to sell.
What this means when you use AI tools
If you put health, biometric or other special category data into an AI tool, for example to summarise a patient letter or draft an HR note, check:
- Is the provider your processor under a DPA, acting only on your instructions?
- Do the terms grant a licence to use, aggregate or anonymise your content?
- Is any of it used for training, by the tool or by the model provider behind it?
- Is the data retained, and where is it processed?
- Do you have your own Art. 9 basis, such as patient consent or the health care exception? That part always sits with you, not the tool.
Wysor is designed for this kind of data. We act only as your processor under Art. 28 GDPR, take no licence to reuse your content, and never train on it or sell it, anonymised or not. Those commitments are in the contract and bind anyone who could ever own Wysor. Your data is encrypted in transit and at rest and hosted in the EU, and every connected AI model provider runs with zero data retention. You can work with GPT, Claude, Gemini and more in one workspace. See medical AI for how this works in clinical practice.
FAQ
What are the special categories of personal data? Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data about sex life or sexual orientation (Art. 9(1) GDPR).
Is health data special category data? Yes. Health data is one of the special categories, and GDPR defines it broadly: anything revealing a person's physical or mental health, including details of the care they receive.
Can special category data be processed with consent? Yes, explicit consent is one of the exceptions in Art. 9(2)(a). It must be specific, informed and clearly given, and in some areas national law limits when consent is enough.
Is anonymised health data still special category data? No. Truly anonymised data is not personal data at all (Recital 26), so Art. 9 no longer applies. Pseudonymised health data, however, remains special category data.
Is criminal record data special category data? Not formally. Criminal convictions and offences are covered by Art. 10 GDPR, which has its own, similarly strict rules.
Further reading
- What is GDPR? A simple explanation
- Patient confidentiality: what it protects and what it doesn't
- What is a data broker?
- Legitimate interest under GDPR: the three-part test explained
- The data trail
Questions about using AI with health data? Reach us at [email protected] or through the in-app contact form.
