GDPR: what should I keep in mind when processing special categories of personal data?

Special categories of personal data (sensitive personal data)

Some personal data belong to the group of “special categories” of personal data: these are personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs, membership of a trade union, genetic data, biometric data, data about health or someone's sexual behavior or sexual orientation. 

Exceptions for processing special categories of personal data

Although the processing of special categories of personal data is in principle prohibited, the GDPR provides an exception for scientific research purposes or projects where the processing of special categories of personal data is necessary. However, this does not mean that you no longer have to comply with other GDPR conditions: you must take appropriate and specific measures to protect the interests and privacy of the data subjects.

In addition to scientific research, there are various other exceptions that allow the processing of special categories of personal data such as when:

  • the data subject has given his or her explicit consent to the processing for one or more specified purposes;
  • the data have been manifestly made public by the data subject;
  • the processing is necessary for reasons of public interest in the field of public health;
  • the processing is necessary for the purposes of preventive or occupational medicine, medical diagnoses, or the provision of healthcare;
  • the processing is necessary to protect the vital interests of the data subject or another natural person;
  • the processing is necessary for reasons of substantial public interest.

In order to lawfully process special categories of personal data, your processing activity (within your research) must be based on one of these exceptions.

Registration in the GDPR register

If you are processing special categories of personal data, such as health data or patient data, you must indicate this in the GDPR Register. In this register you must also motivate why this exception for the processing of special categories of personal data applies to your research. 

More tips

Translated tip


Last modified Dec. 9, 2019, 9:32 a.m.