What is special category data?
Special category data is a defined group of particularly sensitive personal data that receives enhanced protection under the GDPR. It includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for unique identification, health data and information about a person’s sex life or sexual orientation.
Other privacy laws use different terms and may define sensitive information more broadly or narrowly. Organisations should assess the applicable framework rather than assume that one global list applies everywhere.
Why does this data receive additional protection?
Misuse or exposure can create discrimination, exclusion, stigma, financial harm, physical risk or serious loss of autonomy. People may have limited ability to change the underlying characteristic, and the consequences can continue long after the original incident.
Sensitive information can also be inferred from behaviour, location, purchases or communications. An organisation should consider the practical meaning of the data, not only whether a database field has a sensitive label.
What conditions apply to processing?
Under the GDPR, organisations generally need both a lawful basis for processing and a separate condition permitting special-category processing. Possible conditions include explicit consent, employment and social-protection obligations, vital interests, certain public interests, healthcare, legal claims and appropriately safeguarded research.
The correct condition depends on the facts and jurisdiction. Broad consent or a generic business interest should not be assumed to authorise sensitive-data use.
What safeguards are appropriate?
Controls may include strict access, encryption, pseudonymisation, short retention, enhanced monitoring, data minimisation and a data-protection impact assessment. The organisation should document necessity, purpose and the additional legal condition.
Notices should be clear, and unexpected secondary uses should receive particular scrutiny. Vendors processing the data require proportionate due diligence and contractual safeguards.
Frequently asked questions
Is financial information special category data?
Not under the GDPR definition, although it is sensitive and may receive enhanced protection under other laws and organisational standards.
Is a photograph special category data?
Not automatically. It may become biometric special-category data when technically processed for unique identification.
Can special category data be processed with consent?
Explicit consent may be one condition, but it must be valid and may be unsuitable where there is imbalance or no genuine choice.
Does inferred health information count?
It can. Inferences about health may themselves reveal sensitive information and should be assessed according to context and law.
Is a DPIA always required?
Not automatically for every use, but large-scale, innovative or otherwise high-risk sensitive-data processing commonly triggers a DPIA.