Special Category Data: What You May Be Holding Without Knowing It

Update: October 2026

Special category data is the part of personal data that the GDPR protects most strongly. Most organisations know that health records and biometric data are on the list. Fewer realise the list also covers data that reveals or concerns those subjects, and data from which a sensitive trait can be inferred.

This guide covers what counts as special category data, how the law treats indirect and inferred information, why financial data falls outside the list, and where organisations usually find hidden special category data.

Key Takeaways

• Article 9 GDPR prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify a person uniquely, and data concerning health, sex life or sexual orientation, unless one of the ten conditions in Article 9(2) applies. A normal Article 6 lawful basis is needed as well.

• Special category data includes data that reveals or concerns these subjects as well as data that states them outright. In Case C-184/20, the Court of Justice held that publishing data that indirectly discloses a person’s sexual orientation counts as processing special category data. The ICO treats profiling that infers beliefs, health or similar traits as special category processing.

• Financial data, such as bank account and card numbers, is sensitive in the everyday sense and sits outside the Article 9 list. Separate rules cover criminal offence data. Sorting data into the wrong tier leads to errors in both directions.

Article 9 Sets a Closed List With Two Layers of Requirements

Article 9(1) of the GDPR prohibits the processing of the following: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for uniquely identifying a natural person; data concerning health; and data concerning a natural person’s sex life or sexual orientation.

The prohibition lifts only when one of the conditions in Article 9(2) applies. These include explicit consent; employment, social security, and social protection law; vital interests; certain not-for-profit bodies; data manifestly made public by the person; legal claims; substantial public interest; health or social care; public health; and archiving, research, and statistics. The controller also needs a lawful basis under Article 6. Both layers must be in place before processing starts, and the record should show which condition was chosen and why.

The Law Covers Data That Reveals or Concerns a Category

The wording of Article 9(1) matters. It covers personal data revealing the listed matters and data concerning health, sex life or sexual orientation. The ICO’s guidance says special category data includes personal data that specifies details and personal data that reveals or concerns them. The ICO gives a simple example: a statement that Mr X is married to Mr Y clearly reveals information about the sexual orientation of both men.

The Court of Justice reached a similar result in Case C-184/20, decided on 1 August 2022. A Lithuanian rule required public officials to publish a declaration of private interests, which included the name of a spouse or partner. According to commentary on the judgment, the Court held that publishing data capable of indirectly revealing a person’s sexual orientation is processing of special category data. The same judgment found that publishing the partner’s name went beyond what was necessary to prevent conflicts of interest.

The lesson is that data does not need a sensitive label to fall under Article 9. A field that looks harmless in your systems can reveal a protected characteristic once someone reads it.

Inference and Profiling Can Create Special Category Data

The ICO’s guidance on special category data explains when guesses turn into special category data. If information does not clearly reveal one of the categories, it may still be possible to infer details. A person’s name or image may let someone guess their religion or ethnicity. The ICO says you do not have to treat all such names or images as special category data in every instance, and holding them in a customer database does not call for an Article 9 condition.

The position changes when your processing intends to make an inference linked to a special category, or you intend to treat someone differently based on such an inference. The ICO says that in that case you are processing special category data regardless of how confident you are that the inference is correct. It adds that if you carry out any form of profiling that infers things like ethnicity, beliefs, politics, health status, sexual orientation or sex life, you are processing special category data and need an Article 9 condition. Its examples include a social media provider that infers users’ political beliefs to target adverts, whether or not the inference is right.

The ICO notes that it is reviewing its guidance under the Data (Use and Access) Act, so check it for updates. For EU organisations, the test follows the same outline: what the processing does with the data.

Financial and Criminal Offence Data Fall Outside the List

Bank account numbers, payment card details, and similar financial data are sensitive in everyday terms, and security teams should protect them closely. The ICO’s guidance is clear that an individual’s financial data does not raise the same fundamental issues and therefore does not constitute special category data under the UK GDPR.

Data about criminal allegations, proceedings or convictions is not special category data either. Separate rules cover it, with similar safeguards. Article 10 of the GDPR sets those rules, and the ICO has separate guidance on criminal offence data.

This distinction has practical value. Sorting data into the wrong tier either leaves obligations unmet or wastes effort on conditions that do not apply. Financial data still needs a lawful basis, appropriate security under Article 32, and compliance with the other principles in Article 5.

Hidden Special Category Data Usually Sits in Five Places

The following areas often hold data that reveals or concerns an Article 9 category, even when no one labels it as such.

HR and payroll records can hold sickness absence reasons, occupational health reports, disability adjustments and union subscription deductions, which reveal health and trade union membership. Accident and incident logs record injuries. Benefits and insurance records can hold health information.

Appointment and booking data can reveal health. The ICO notes that a single GP or hospital appointment may say nothing about a person’s health, because it could be a check-up or screening, while a list of appointments at an osteopath clinic or an invoice for physiotherapy sessions can reasonably support an inference of health data.

Biometric systems, such as fingerprint turnstiles, face matching or voice recognition, create special category data when used to identify a person. The ICO says digital photographs are not automatically biometric data, and become biometric data when specific technical processing, such as creating a template for automated matching, is applied. Our guide to biometric data and GDPR covers the conditions.

Wearables and wellness tools produce health data. The ICO’s examples of health data include fitness tracker data.

Marketing and analytics profiles can create special category data when they infer political views, health status, religion or sexual orientation to target people.

An Audit Can Find Special Category Data in Four Steps

Start with your record of processing activities. Our guide to building a record of processing activities explains the structure. Add a column that marks each activity involving an Article 9 category, directly or by inference.

Next, search free-text fields. Notes boxes, case files and email attachments often hold health or belief information that no structured field captures.

Then assign the Article 9(2) condition and the Article 6 basis for each activity, and write down the reasons. Check whether a data protection impact assessment is needed for large-scale processing of special category data.

Finally, restrict access and set retention. Special category data should reach fewer people and be kept for a shorter, justified period.

GDPRLocal helps organisations map special category data, select Article 9 conditions and impact assessments. See our GDPR consultant services.

Conclusion

Special category data is defined by what it reveals or concerns, and by how the controller uses it. A name, an appointment list, a payroll deduction, or a browsing profile can all fall under Article 9, depending on how they are used.

The practical response is a mapped inventory, a recorded Article 9 condition for each activity, and an honest sort between sensitive data and special category data.

Frequently Asked Questions

Is Financial Data Special Category Data Under the GDPR?

No. Article 9 does not list financial data, and the ICO states that financial data does not constitute special category data for the UK GDPR. It is still personal data that needs a lawful basis and strong security.

Can Inferred Information Count as Special Category Data?

Yes. The ICO says that if you intend to make an inference linked to a special category, or to treat people differently based on one, you are processing special category data regardless of how confident you are that the inference is correct. The Court of Justice has also held that data indirectly revealing sexual orientation falls under Article 9.

What Do We Need Before Processing Special Category Data?

You need a lawful basis under Article 6 and a condition under Article 9(2), and you should record both with the reasons. Large-scale processing of special category data also calls for a data protection impact assessment.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.