Key points
- Sensitive data is a special category under the GDPR that affects people’s integrity and privacy; processing it requires enhanced measures.
- These categories are listed in Article 9 of the GDPR: racial or ethnic origin, political opinions, religious beliefs, health data, biometrics and sex life.
- Trade union membership and genetic data are also among these categories, while criminal convictions fall under separate articles.
- Processing sensitive data is prohibited in principle, subject to strict exceptions laid down by EU law.
- One of the exemptions is the explicit consent of the data subject, provided it is framed precisely.
- Any organisation relying on an exemption remains subject to increased responsibilities and must uphold and document the rights of the data subjects.
Sensitive data is a special category under the GDPR, because it directly affects the integrity and privacy of the data subjects. Its processing entails strict legal obligations and requires enhanced measures to ensure data security. Every organisation needs to understand these requirements to avoid any infringement, which may be heavily penalised. This article sets out the legal bases, the types of data concerned and the essential precautions to know in order to manage high-risk information in a compliant way.
What are the categories of sensitive data under the GDPR?
The GDPR precisely identifies a set of special categories of data. They call for heightened vigilance in their collection, processing and storage. Failing to single out these types of information exposes any controller to serious legal and reputational risks.
These categories are listed in Article 9 of the General Data Protection Regulation and include, among others, biometric information, racial or ethnic origin, political opinions, religious or philosophical beliefs, and data concerning health or sex life.
Detailed list of the main sensitive data concerned
To grasp the full scope, it helps to review the main types of high-risk data governed by the GDPR. They deserve specific attention when designing any project that involves processing sensitive data. To understand what brings information within the GDPR’s special regime, you can also read what counts as personal data.
- Data revealing racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic and biometric data
- Health data
- Data concerning sex life or sexual orientation
Other items such as criminal convictions are also regulated, although they fall under different articles within the same legal framework. Entities handling this sensitive information must therefore systematically analyse whether their activity involves exposure to these sensitive categories.
Summary table: types of sensitive data and practical examples
| Category of sensitive data | Practical example |
|---|---|
| Racial/ethnic origin | Indication of membership of an ethnic group in a form |
| Political opinion | Participation in a political petition recorded electronically |
| Health data | Medical test result saved in a patient file |
| Biometrics | Fingerprints used to access secure premises |
Correctly identifying these special categories of data is the essential first step in implementing a robust data protection policy that complies with the GDPR.
What protection principles and processing prohibitions apply to sensitive data?
Processing sensitive data is prohibited in principle, subject to very strict exceptions laid down by EU law. This framework is primarily intended to prevent any misuse of information that could seriously harm the data subject. The aim is to considerably strengthen data security where data carries a higher level of risk. Support from a specialist can make these rules easier to understand: engaging a DPO lawyer for personal data protection is then relevant to bring sensitive processing into compliance.
An organisation that relies on an exemption from the general prohibition remains subject to increased responsibilities. Even in these exceptional situations, the rights of the data subjects must be upheld and documented.
The prohibition in principle and its main exceptions
The basic rule remains the prohibition on processing sensitive data, laid down in Article 9 of the GDPR. However, EU law provides for certain cases where processing becomes possible, subject to a precise framework. Each controller must then identify its legal basis and make sure it acts only in strict compliance with the conditions imposed.
- Explicit consent of the data subject
- Necessity for carrying out obligations and exercising rights in the field of employment law or social security
- Protection of the vital interests of the person where their consent cannot be obtained
- Processing in the course of the legitimate activities of an association or foundation with a specific aim (example: a religious aim)
- Processing necessary for the purposes of preventive medicine or the management of health services
Each exception must rest on a clear legal provision, not simply on practical convenience. Keeping a record of the justification relied on helps you prepare for any future audit or dispute.
Explicit consent requirement and conditions of validity
Where no other exception provided for in Article 9 applies, only explicit consent makes the processing of sensitive data lawful. The GDPR insists on the clarity of this step: asking for vague or generic permission is not enough. The wording must describe the purpose of the processing precisely and allow the data subject to withdraw their agreement easily at any time.
A formal signature or a ticked box without a clear explanation is not enough. Proof of explicit consent must be available at any time, throughout the entire duration of the processing.
How do you protect the processing of sensitive data in practice?
Article 32 of the GDPR requires data security measures appropriate to the risk, in order to limit the consequences of a breach; the level of requirement rises when the data processed is sensitive or high-risk. This generally means going beyond standard IT safeguards and using additional targeted techniques.
This dynamic approach adapts to the nature of the risks involved and to the current state of the art. Each stage of the data life cycle, from collection to destruction, must be subject to regular assessment of the measures in place.
Implementing appropriate security measures
Working effectively on data security requires a comprehensive strategy combining technical tools and a suitable internal organisation. Acting quickly in the event of a breach protects not only individuals but also the entity against substantial administrative penalties.
- Systematic encryption of information exchanged regularly
- Access limited to strictly authorised persons
- Pseudonymisation or anonymisation wherever feasible
- Periodic external audit to assess existing safeguards
- Secure back-up and destruction of obsolete data
In addition, adopting an incident response plan makes it possible to react immediately in the event of a leak or unlawful access. This advance preparation limits the negative impact, from both a regulatory and a human perspective.
Role and obligations of the Data Protection Officer (DPO)
The GDPR requires certain organisations to appoint a Data Protection Officer (DPO), who plays a central role in monitoring compliance with legal obligations. This professional specifically oversees the processing of sensitive data, from compliance to internal documentation.
The DPO helps raise awareness among internal teams and acts as the contact point with the CNIL (the French data protection authority) when difficulties arise. The DPO facilitates data protection impact assessments (DPIA, or PIA), which become mandatory where there is a high risk linked to the processing of high-risk data.
Frequently asked questions on protecting sensitive data under the GDPR
What processing of sensitive data does the GDPR prohibit?
The GDPR prohibits any processing of sensitive data outside its exhaustively listed exceptions. No organisation may collect, store or use information falling within the high-risk categories, such as health or religious beliefs, without a sound legal basis. If no clear exception applies, the processing must stop in order to comply with legal obligations.
Unlawful processing exposes the organisation to administrative and even criminal penalties, which makes a regular prior audit indispensable.
What security measures are required to protect sensitive data?
Appropriate, enhanced security measures must be put in place to prevent unauthorised access and limit the consequences of a breach. This involves:
- Use of encryption during storage and transfer
- Restricting physical and logical access to what is strictly necessary
- Regular checks and security audits
- Pseudonymisation of data, where relevant
| Measure | Main benefit |
|---|---|
| Encryption | Protects information during external access or in the event of loss |
| Pseudonymisation | Reduces the direct identifiability of the data subject |
Investing in reliable technologies remains essential for any organisation handling high-risk data, alongside regular staff training.
Is explicit consent always enough to process sensitive data?
The GDPR requires explicit consent in several situations, but it is only valid if the person has clear information on how the data will be used and gives their agreement freely, without pressure or ambiguity. Some processing nevertheless remains prohibited, even with consent, if it breaches other principles of the regulation. Consent does not replace the obligation to assess the proportionality and necessity of the processing.
It is therefore advisable to check the compliance of the consent collection procedure systematically, including through a written medium that is easy to consult, to support traceability.
Who must carry out a data protection impact assessment (DPIA)?
A data protection impact assessment (DPIA, or PIA) is mandatory whenever the processing of sensitive data presents a high risk to the rights and freedoms of the data subjects. This is often the case in the health and social sectors, or where several databases are cross-referenced. The assessment must be carried out before the project actually starts.
- Controller: orchestrates the process
- DPO: supervisor and adviser
- Technical team: operational security support
Documenting this assessment proves that the risks linked to the processing of high-risk data have been actively addressed and shows a commitment to meeting GDPR requirements.
This page provides general information and does not constitute legal advice: every situation is different. For a specific matter, see our GDPR compliance lawyer page.
